secure-code-auditor

Solid

Backend security auditor for Django and DRF on an OWASP Top 10 (2025), API Security Top 10 (2023), and ASVS 5.0 foundation. Use when backend code is written or reviewed and touches authentication, sessions, cookies, JWT, OAuth2/OIDC, API keys, password hashing, permissions, access control, IDOR, SSRF, path traversal, open redirect, impersonation, SQL/command/template injection, LDAP, row-level security, encrypted columns, NoSQL, Redis, file uploads, S3, serializers, rate limiting, CSRF/CORS, OpenAPI schema, GraphQL, Django Ninja, gRPC, AI agents, MCP tools, secrets, payments, webhooks, Celery, Django tasks, race conditions, ReDoS, caching, deserialization, async/ASGI, WebSockets, audit logging, erasure, retention, personal data, migrations, JWKS, mutual TLS, SECRET_KEY, SBOM, X-Forwarded-For, SPF/DKIM/DMARC, or deployment config, even if "security" is never used. Review-time returns prioritized findings with fixes; write-time applies secure defaults. Django/DRF-first; general layer suits any stack.

API & Backend 4 stars 0 forks Updated 3 days ago MIT

Install

View on GitHub

Quality Score: 83/100

Stars 20%

Recency 20%

100

Frontmatter 20%

Documentation 15%

100

Issue Health 10%

License 10%

100

Description 5%

100

Skill Content

# secure-code-auditor A backend security skill. It reviews server-side code, and it applies secure defaults while new code is written. Django and DRF are the deep specialty. A stack-neutral layer under them suits any backend. The scope is the backend: server-side code, data, configuration, and the deployment the backend owns. Browser and frontend concerns stay out, except where the server controls the output. Other agents (Codex, Cursor, Gemini CLI) reuse this content through `AGENTS.md`, with Claude as the primary integration. ## Self-improvement This skill improves itself after a task. `SELF-IMPROVEMENT.md` gives the rules. 1. Before the main task: if the directory `~/.skill-improvements/secure-code-auditor/` exists, do section 3 of `SELF-IMPROVEMENT.md`. 2. During the main task: change no file of this skill, unless the main task is a change to this skill. When this skill gives wrong, old, unclear, or incomplete information, add one item to your task list: "Skill review: secure-code-auditor". 3. After the main task: if you found a defect in this skill, load `SELF-IMPROVEMENT.md` and obey it. ## How the reference material is organized Everything sits on the **OWASP Top 10:2025 spine**. Each reference has two layers. The **principle layer** states the vulnerability and the defense in stack-neutral terms. The **Django & DRF layer** holds the settings, the code patterns, the correct and wrong examples, and the gotchas. A sub-topic checklist splits the sa...

Details

Author: n-shadloo
Repository: n-shadloo/secure-code-auditor
Created: 2 months ago
Last Updated: 3 days ago
Language: Python
License: MIT

Integrates with

Redis · Database Django · Backend OAuth · Auth Model Context Protocol · AI GraphQL · API WebSocket · API gRPC · API

Similar Skills

Semantically similar based on skill content — not just same category

Code & Development Listed

secure-coding

Apply OWASP-grounded secure coding when writing or reviewing backend, frontend, API, data, or infrastructure code, handling auth/secrets/user input, or doing a security pass. Use whenever code touches authentication, authorization, secrets, databases, file/network I/O, deserialization, or external input — and during the security-engineer QA lens and /ship-check.

1 Updated 1 months ago

StielChancellor

API & Backend Listed

dev-secure-coding

Use when writing or modifying application code in any language — endpoints, handlers, database queries, HTTP clients, file access, forms, config loading — and whenever adding or upgrading a dependency. Applies whenever code touches user input, credentials, SQL, shell commands, file paths, external URLs, or authentication, even if the request never mentions security. Also use before declaring code finished, to self-check what was written. Triggers on "create an endpoint", "add this library", "connect to this API", "save this to the database", "read this file", "add login". Complements the stack skills (dev-python-clean-code, golang-clean-code, dev-react-internal, dev-angular-internal) rather than replacing them.

0 Updated 1 months ago

slackwero

API & Backend Listed

secure-coding

This skill should be used while WRITING any backend, API, auth, or data-handling code for a web app or SaaS — to prevent vulnerabilities before they ship, not to audit them after. Trigger phrases include "add an endpoint", "handle user input", "store user data", "is this secure", "build the API", "save to the database", "handle the form", "user uploads", "process payment", "handle secrets", "set up CORS", "rate limit". It applies OWASP Top 10 prevention, input validation, secrets hygiene, and GDPR basics as you build.

4 Updated 1 months ago

MartinOlivero