Secure Backend Code Generation and Review

Backend Security Coder is a hands-on secure-coding skill for writing backend code that resists common attack vectors, covering input validation, authentication, database protection, API security and secure error handling. It draws a clear line against a security-auditor role: this skill is for writing secure backend code, API security implementation, database security configuration, authentication coding and vulnerability fixes, while a security-auditor agent would instead handle audits, compliance assessments, DevSecOps pipeline design, threat modeling and penetration-test planning.

Its capability areas include:

• General secure coding: input validation and allowlisting, prevention of SQL, NoSQL, LDAP and command injection, secure error handling that avoids information leakage, sensitive-data protection with encryption at rest and in transit, and secret management with rotation.
• HTTP security headers and cookies: Content Security Policy with nonce/hash strategies, HSTS, X-Frame-Options, X-Content-Type-Options, Referrer-Policy, HttpOnly/Secure/SameSite cookie attributes, and strict CORS configuration.
• CSRF protection: anti-CSRF tokens, Origin/Referer header validation, double-submit cookies, and SameSite enforcement.
• Output rendering security: context-aware HTML/JavaScript/CSS/URL encoding, auto-escaping templates, JSON hijacking prevention, XXE prevention, and path-traversal-safe file serving.
• Database security: parameterized queries and prepared statements, connection credential management, field-level encryption, role-based access control, and audit logging.
• API security: JWT and OAuth 2.0/2.1 authentication, RBAC/ABAC authorization, request validation and payload limits, rate limiting, and consistent, security-aware error responses.
• External requests security: destination allowlisting, URL and protocol validation, SSRF prevention, timeouts and response-size limits, and certificate validation.
• Authentication and authorization: multi-factor authentication (TOTP, hardware tokens), password hashing with bcrypt or Argon2, secure session tokens, and PKCE-based OAuth flows.
• Logging, monitoring and cloud/infrastructure security: sanitized audit logs, SIEM integration, secure environment variables, container image scanning, and integration with HashiCorp Vault, AWS Secrets Manager or Azure Key Vault.

The bundled resources/implementation-playbook.md gives a concrete procedure: trace every untrusted field from request to database, outbound call and response, recording the resource owner separately from the authenticated caller; implement allowlisted inputs, parameterized persistence and server-side resource authorization before any side effect; and exercise anonymous, wrong-role, wrong-tenant, malformed and oversized requests in a disposable environment, checking that denied requests produced no database or outbound-call effect. Its worked example is a cross-tenant invoice edit, fixed with a tenant-bound lookup and tests for both own-tenant success and cross-tenant denial with unchanged stored data.

Use it for backend security coder tasks and workflows needing guidance, best practices or checklists, and proactively for backend security implementations or security code reviews. Do not use it for tasks unrelated to backend security coding, or where a different domain or tool fits better; use the separate security-auditor role instead for high-level audits, compliance assessments and threat modeling rather than hands-on code.

Inputs to the playbook are endpoint code, the request schema, the identity/tenant model, the persistence adapter and existing tests. Output is a verification report naming the actual files or configuration changed, the checks performed, the observed results, and any environment left untested, with evidence kept sufficient to reproduce the conclusion. Two limitations are explicit: an authenticated request is not proof of resource ownership, and a passing scanner is not proof that authorization actually works.

It draws on the OWASP Top 10 and secure coding guidelines as its knowledge base, and names integration points with secret managers (HashiCorp Vault, AWS Secrets Manager, Azure Key Vault) and SIEM tooling for security event monitoring.

It suits backend developers implementing authentication, API and database security directly in code, and teams that need a concrete verification procedure - trace, restrict, then adversarially test - for authorization and injection fixes rather than a high-level audit.