secure-ship
Security skill pack for developers shipping production code. Based on real forensic findings from Malaysian court cases under PDPA 2024.
When to Activate
- User asks to "secure my project" or "check security"
- User mentions PDPA, OWASP, or security audit
- User is about to deploy to production
- User asks about SQL injection, webhooks, rate limiting, or audit logs
- User says "is my code safe?" or "can I get sued?"
Sub-Skills
Route to the appropriate sub-skill based on the request:
| Request | Route to |
|---|---|
| "Run a security audit" / "Check PDPA compliance" / "OWASP assessment" | $pdpa-security-audit |
| "Access control" / "IDOR" / "tenant isolation" / "RBAC" / "permissions" | $access-control-patterns |
| "Check for SQL injection" / "Fix my queries" / "parameterized" | $sql-injection-prevention |
| "Validate input" / "XSS" / "path traversal" / "sanitize" / "file upload" | $input-validation |
| "Fix secrets" / "hardcoded API key" / ".env setup" / "secret rotation" | $secrets-management |
| "Security headers" / "CSP" / "HSTS" / "clickjacking" / "helmet" | $security-headers |
| "Fix auth" / "password hashing" / "JWT" / "session" / "brute force" | $auth-hardening |
| "CORS" / "cross-origin" / "preflight" / "Access-Control" | $cors-configuration |
| "Encrypt data" / "encrypt PII" / "AES" / "field encryption" / "PDPA encryption" | $data-encryption |
| "Error leaking" / "stack trace" / "verbose errors" / "hide errors" | $error-handling-security |
| "Add audit logging" / "I need logs" / "PDPA audit trail" | $audit-logging-workers |
| "Fix webhook" / "race condition" / "double credit" / "idempotency" | $webhook-security |
| "Add security to CI" / "SAST" / "secret scanning" / "CodeQL" | $ci-security-gates |
| "Add rate limiting" / "prevent abuse" / "too many requests" | $rate-limiting |
| "SSRF" / "fetch user URL" / "URL preview" / "metadata endpoint" / "egress" | $ssrf-prevention |
| "Check dependencies" / "typosquatting" / "malicious package" / "lockfile" | $dependency-lockfile-audit |
| General "secure my project" | Run $pdpa-security-audit first, then fix findings using other sub-skills |
Quick Audit Checklist
When a user asks "is my code secure?", run through this checklist:
[ ] All DB queries use parameterized bindings (no string concatenation)
[ ] All protected routes enforce authentication and authorization
[ ] All tenant-owned queries are scoped by tenantId/userId
[ ] IDOR tests cover cross-tenant access attempts
[ ] All user input validated with schema (Zod/Joi/Pydantic)
[ ] No hardcoded secrets in source code
[ ] .env files are gitignored, .env.example committed
[ ] Passwords hashed with Argon2id or bcrypt (cost 12+)
[ ] Auth enforced on all protected routes
[ ] Login rate-limited (brute-force protection)
[ ] JWTs expire in 15 minutes, refresh tokens in httpOnly cookies
[ ] CORS whitelist specific origins (no wildcard with credentials)
[ ] PII fields encrypted at rest (AES-256-GCM)
[ ] Security headers configured (CSP, HSTS, X-Frame-Options)
[ ] Error responses don't leak stack traces or SQL queries
[ ] Payment webhooks have idempotency guards
[ ] Webhook tokens use timing-safe comparison
[ ] Structured audit logs on sensitive operations
[ ] Tests exist and run in CI before deploy
[ ] npm audit / dependency scanning in CI
[ ] SAST (CodeQL/Semgrep) in CI
[ ] Secret scanning (Gitleaks) in CI
[ ] Lockfile committed and verified with npm ci
[ ] No typosquatted or suspicious dependencies
[ ] Rate limiting on authenticated endpoints
[ ] File uploads validate magic bytes, not just extension
[ ] No user input passed to shell commands or eval()
[ ] No raw server-side fetch of user-provided URLs
[ ] SSRF controls block private, loopback, link-local, and metadata IPs
[ ] License file exists, no GPL violations
If any item fails, route to the appropriate sub-skill to fix it.
Legal Context
This skill pack exists because of PDPA 2010 (Pindaan 2024) which criminalizes negligent Data Processors:
- Seksyen 5(1)(2): RM1,000,000 fine or 3 years prison for security failures
- Akta Hak Cipta 1987: RM2,000-RM20,000 per file for copyright violations
- Kanun Keseksaan 417/419: 5-7 years for fraud/misrepresentation
The standard of care is: "Did you implement security measures proportionate to the data you handle?" These skills help you demonstrate that standard was met.