A Claude Code skill that helps you ship secure applications. It works in two modes:
- Audit. Reviews an existing codebase against a stack-agnostic, OWASP-style checklist and reports gaps with severity, exact locations, and fixes.
- Guard while building. Enforces secure patterns as you write a feature (an endpoint, login flow, query, upload handler), before the insecure version lands.
It covers web apps and APIs, and it works default-deny: it won't call a domain
"fine" unless it inspected the code, and every finding cites a concrete
file:line and a fix.
12 domains, each as Check → Detect → Fix:
| Domain | Examples |
|---|---|
| Authentication | password hashing, session/JWT handling, brute-force lockout, MFA, password reset |
| Authorization | default-deny, IDOR / object-level checks, privilege escalation, mass assignment |
| Secrets | hardcoded keys, repo hygiene, client-side leakage |
| Injection & input | SQLi, command injection, XSS, SSRF, path traversal, unsafe deserialization, schema validation |
| Transport & cookies | TLS/HSTS, Secure/HttpOnly/SameSite |
| CORS & CSRF | origin allowlists, anti-CSRF tokens |
| Rate limiting & DoS | endpoint throttling, payload/resource limits |
| Security headers | CSP, nosniff, frame-ancestors, referrer/permissions policy |
| Dependencies | known CVEs, lockfiles, supply-chain hygiene |
| Error handling & logging | no leakage to users, no secrets/PII in logs, audit trail |
| Data protection | encryption at rest, data minimization |
| File uploads | type/size validation, storage isolation |
Copy the security-hardening/ directory into your Claude Code skills folder.
Personal (all your projects):
# macOS / Linux
git clone https://github.com/JoeyPatricio/security-hardening-skill.git
cp -r security-hardening-skill/security-hardening ~/.claude/skills/# Windows (PowerShell)
git clone https://github.com/JoeyPatricio/security-hardening-skill.git
Copy-Item -Recurse security-hardening-skill\security-hardening "$env:USERPROFILE\.claude\skills\"Per-project (commit it with your repo): copy security-hardening/ into your
project's .claude/skills/ instead.
Then start a fresh Claude Code session; skills load at startup.
Describe the intent and the skill triggers on its own:
- "Audit this app's security" / "review this codebase for security issues"
- "Make sure this login endpoint is secure"
- "Is this API production-ready from a security standpoint?"
You can also invoke it with /security-hardening.
Run it alongside Claude Code's built-in /security-review and dedicated scanners
(npm audit, pip-audit, SAST); the skill points you at those where relevant.
security-hardening/
├── SKILL.md # entry point: principles + the two modes
└── references/
├── checklist.md # the 12-domain checklist (Check → Detect → Fix)
└── report-template.md # audit output format + severity rubric
MIT © 2026 Joe Patricio