api-security-hardening

OverviewHistoryStatsSecurity

npx skills add ...

Documentation

SKILL.md

REST API security hardening with authentication, rate limiting, input validation, security headers. Use for production APIs, security audits, defense-in-depth, or encountering vulnerabilities, injection attacks, CORS issues.

npx skills add secondsky/claude-skills --skill api-security-hardening

Documentation

SKILL.mdView source

API Security Hardening

Protect REST APIs against common vulnerabilities with multiple security layers.

Security Middleware Stack (Express)

const helmet = require('helmet');
const rateLimit = require(

Input Validation

Security Headers

Security Checklist

HTTPS everywhere
Authentication on all protected routes
Input validation and sanitization
Rate limiting enabled
Security headers configured
CORS restricted to allowed origins
No stack traces in production errors
Audit logging enabled
Dependencies regularly updated

Additional Implementations

See references/python-nginx.md for:

Python FastAPI security middleware
Pydantic input validation with password rules
Nginx SSL/TLS and security headers configuration
HTTP Parameter Pollution prevention

Never Do

Trust user input without validation
Return detailed errors in production
Store secrets in code
Use GET for state-changing operations
Disable security for convenience

npx skills add secondsky/claude-skills --skill api-security-hardening

Documentation

SKILL.md

api-security-hardening skill by secondsky | SkillBundle

const { body, validationResult } = require('express-validator');
const escapeHtml = require('escape-html');
 
app.post('/users',
  body('email').isEmail().normalizeEmail(),
  body('password').isLength({ min: 8 }).matches(/[A-Z]/).matches(/[0-9]/),
  // express-validator v7+ removed the built-in .escape() sanitizer; use a
  // customSanitizer backed by `escape-html` to HTML-escape the value.
  body('name').trim().isLength({ max: 100 }).customSanitizer(v => escapeHtml(v)),
  (req, res) => {
    const errors = validationResult(req);
    if (!errors.isEmpty()) {
      return res.status(400).json({ errors: errors.array() });
    }
    // Process request
  }
);

app.use((req, res, next) => {
  res.setHeader('Content-Security-Policy', "default-src 'self'");
  res.setHeader('X-Frame-Options', 'DENY');
  res.setHeader('X-Content-Type-Options', 'nosniff');
  res.setHeader('Strict-Transport-Security', 'max-age=31536000; includeSubDomains');
  res.setHeader('X-XSS-Protection', '1; mode=block');
  next();
});