# secure-code-guardian

> Claude/Codex skill by [@jeffallan](https://omgskills.com/library/jeffallan/index.md) · 12k stars · Updated 2026-10-30

Use when implementing authentication/authorization, securing user input, or preventing OWASP Top 10 vulnerabilities — including custom security implementations such as hashing passwords with bcrypt/argon2, sanitizing SQL queries with parameterized statements, configuring CORS/CSP headers, validating input with Zod, and setting up JWT tokens. Invoke for authentication, authorization, input validation, encryption, OWASP Top 10 prevention, secure session management, and security hardening. For pre-built OAuth/SSO integrations or standalone security audits, consider a more specialized skill.

Tags: ai-agents, claude, claude-code, claude-marketplace, claude-skills

## Install

```sh
git clone https://github.com/Jeffallan/claude-skills /tmp/claude-skills && ln -s /tmp/claude-skills/skills/secure-code-guardian ~/.claude/skills/secure-code-guardian
```

## From README

Secure Code Guardian Core Workflow Threat model — Identify attack surface and threats Design — Plan security controls Implement — Write secure code with defense in depth; see code examples below Validate — Test security controls with explicit checkpoints (see below) Document — Record security decisions Validation Checkpoints After each implementation step, verify: Authentication: Test brute-force protection (lockout/rate limit triggers), session fixation resistance, token expiration, and invalid-credential error messages (must not leak user existence). Authorization: Verify horizontal and vertical privilege escalation paths are blocked; test with tokens belonging to different roles/users. Input handling: Confirm SQL injection payloads (' OR 1=1--) are rejected; confirm XSS payloads ( alert(1) ) are escaped or rejected. Headers/CORS: Validate with a security scanner (e.g., curl -I, Mozilla Observatory) that security headers are present and CORS origin allowlist is correct.

## Links

- HTML page: https://omgskills.com/library/jeffallan/claude-skills/secure-code-guardian/
- GitHub: https://github.com/Jeffallan/claude-skills
- Author: [@jeffallan](https://omgskills.com/library/jeffallan/index.md)

## More from this repo

- [api-designer](https://omgskills.com/library/jeffallan/claude-skills/api-designer/index.md) — Used when designing REST or GraphQL APIs, creating OpenAPI specifications, or planning API architecture.
   - [@jeffallan](https://omgskills.com/library/jeffallan/index.md) · 12k stars
- [architecture-designer](https://omgskills.com/library/jeffallan/claude-skills/architecture-designer/index.md) — Used when designing new high-level system architecture, reviewing existing designs, or making architectural decisions.
   - [@jeffallan](https://omgskills.com/library/jeffallan/index.md) · 12k stars
- [atlassian-mcp](https://omgskills.com/library/jeffallan/claude-skills/atlassian-mcp/index.md) — Integrates with Atlassian products to manage project tracking and documentation via MCP protocol.
   - [@jeffallan](https://omgskills.com/library/jeffallan/index.md) · 12k stars