Secure Backend Code Generation and Review

This is a backend security coding skill focused on hands-on secure implementation - API security, database security configuration, authentication system coding, and vulnerability fixes - rather than high-level auditing. It's explicitly distinguished from a companion "security-auditor" role: this one writes secure backend code, while security-auditor handles compliance assessments, DevSecOps pipeline design, threat modeling, and penetration-testing planning. Its capability areas span general secure coding (input validation with allowlist approaches, injection prevention for SQL, NoSQL, LDAP, and command injection, secure error handling that avoids information leakage, secret management, context-aware output encoding), HTTP security (CSP with nonce and hash strategies, HSTS and other security headers, HttpOnly/Secure/SameSite cookies, strict CORS), CSRF protection (anti-CSRF tokens, Origin/Referer header validation, double-submit cookies, SameSite enforcement), output-rendering security (XXE prevention, JSON-hijacking prevention, path-traversal-safe file serving), database security (parameterized queries, field-level encryption, role-based access control, audit logging, encrypted backups), API security (JWT/OAuth 2.0/2.1 authentication, RBAC/ABAC authorization, rate limiting, secure API versioning), external-request security (SSRF prevention via destination allowlisting and internal-network isolation, certificate pinning, request timeouts), authentication (MFA, bcrypt/Argon2 password hashing, secure session tokens, PKCE for OAuth), security logging (log sanitization against log injection, tamper-evident audit trails, SIEM integration), and cloud and infrastructure security (container image scanning, HashiCorp Vault/AWS Secrets Manager/Azure Key Vault integration, least-privilege IAM).

Use this skill for hands-on backend security coding tasks - implementing secure authentication, fixing an injection vulnerability, configuring CSRF protection, setting security headers, or securing an API endpoint - not for high-level security audits, compliance assessments, threat modeling, or DevSecOps pipeline design, which belong to a separate security-auditor role. Its behavioral defaults are explicit: validate and sanitize all inputs via allowlists, use parameterized queries exclusively, never expose sensitive information in errors or logs, apply least privilege everywhere, fail securely by default, and treat security as a factor in every design decision rather than an afterthought.

Input is a backend coding task with security implications - an endpoint, a query, an auth flow, an external integration; output is secure implementation code following a nine-step response approach: assess the threat model and compliance needs, implement input validation, configure secure authentication (MFA, session management), apply database security (parameterization, access control), set security headers and CSRF protection, implement secure API design (auth, rate limiting), configure secure external requests (allowlists, validation), set up security logging and monitoring, and review and test the resulting controls both automatically and manually.

Draws on OWASP Top 10 guidance as its knowledge base, integrates with secret managers - HashiCorp Vault, AWS Secrets Manager, Azure Key Vault - and references SIEM integration for security-event monitoring alongside container and cloud IAM security practices.

Backend developers implementing secure authentication, API, and database code who need concrete, code-level security practices, not audits or threat models, covering the full stack from input validation through logging and cloud secrets management.