# security-and-hardening

> Claude/Codex skill by [@addyosmani](https://omgskills.com/library/addyosmani/index.md) · 81k stars · 36k installs · Updated 2026-07-26

Hardens code against vulnerabilities. Use when handling user input, authentication, data storage, or external integrations. Use when building any feature that accepts untrusted data, manages user sessions, or interacts with third-party services.

Tags: agent-skills, antigravity, claude-code, codex, cursor, skills

## Install

```sh
git clone https://github.com/addyosmani/agent-skills /tmp/agent-skills && ln -s /tmp/agent-skills/skills/security-and-hardening ~/.claude/skills/security-and-hardening
```

## From README

Security and Hardening Overview Security-first development practices for web applications. Treat every external input as hostile, every secret as sacred, and every authorization check as mandatory. Security isn't a phase — it's a constraint on every line of code that touches user data, authentication, or external systems. When to Use Building anything that accepts user input Implementing authentication or authorization Storing or transmitting sensitive data Integrating with external APIs or services Adding file uploads, webhooks, or callbacks Handling payment or PII data Process: Threat Model First Controls bolted on without a threat model are guesses. Before hardening, spend five minutes thinking like an attacker: Map the trust boundaries. Where does untrusted data cross into your system? HTTP requests, form fields, file uploads, webhooks, third-party APIs, message queues, and LLM output. Every boundary is attack surface. Name the assets. What's worth stealing or breaking?

## Links

- HTML page: https://omgskills.com/skills/addyosmani/agent-skills/security-and-hardening/
- GitHub: https://github.com/addyosmani/agent-skills
- Author: [@addyosmani](https://omgskills.com/library/addyosmani/index.md)

## More from this repo

- [api-and-interface-design](https://omgskills.com/skills/addyosmani/agent-skills/skills/api-and-interface-design/index.md) — Guides stable API and interface design.
   - [@addyosmani](https://omgskills.com/library/addyosmani/index.md) · 93k stars
- [constraint-driven-development](https://omgskills.com/skills/addyosmani/agent-skills/skills/constraint-driven-development/index.md) — Establishes a project's quality bar as a written contract and stops agents quietly lowering it.
   - [@addyosmani](https://omgskills.com/library/addyosmani/index.md) · 91k stars
- [doubt-driven-development](https://omgskills.com/skills/addyosmani/agent-skills/skills/doubt-driven-development/index.md) — Subjects every non-trivial decision to a fresh-context adversarial review before it stands.
   - [@addyosmani](https://omgskills.com/library/addyosmani/index.md) · 87k stars