security-and-auth

# Security and Authentication ## When to Activate Read this skill when you are: - writing or reviewing ANY code that touches authentication, authorization, session/token handling, or credential storage; - adding or changing a route, WebSocket upgrade, proxy relay, or edge function that handles sensitive data or mutating actions; - reviewing rate limiting, CORS, RLS policies, or input validation; - provisioning cloud infrastructure, IAM policies, a CI/CD pipeline, or edge/CDN config — load `references/cloud-and-ci-cd-security.md` for the least-privilege deploy-substrate posture; - reviewing LLM-adjacent code (prompt handling, tool scopes, agent authority) — load `references/owasp.md` for the OWASP LLM Top-10 rubric; - hunting for a reachable, exploitable vulnerability (vs. a broad best-practices pass) — load `references/vulnerability-hunting.md` for reachability-first triage; - filing or triaging a security finding — severity requires a PoC; load `references/proof-of-exploitability.md`. The machine-first `activation_triggers` frontmatter remains the canonical auto-load rule; this section is its human-scannable mirror. ## Fail-Fast Rule If any security invariant, validation, or precondition fails, **stop and return a structured rejection**. Never degrade security silently. Never skip auth checks "because it's internal." Never log secrets, even partially, unless behind explicit masking. Never assume a route is unreachable. ## Reference Files — progressive ...