Dev-Security — Production Security Hardening

Treat security as a build constraint, not a cleanup step. This skill is the authoritative source for authentication, authorization, input validation, secrets, headers, rate limiting, supply-chain security policy and evidence requirements, PII handling, and agentic AI safety. Validation ownership split: this skill owns what the validation schema enforces (content/policy); placement (boundary-only validation) is owned by dev-architecture §4. dev-backend delegates here for policy and verification depth. dev-frontend remains responsible for UI implementation, but frontend security touchpoints such as CSP compliance, CORS behavior, XSS prevention, and dependency auditing are defined here. This skill activates by change-surface whenever code crosses a trust boundary or changes the blast radius of a failure.

Before security work, read dev for classification, fast paths, rule authority, family invariants, verification, and safety; current CVEs/public evidence follow its Conditional Routes.

Threat Model First

Rule (SEC-THREAT-01): Security-sensitive changes start with a repo-grounded threat model, then controls. Do not begin with a checklist and assume it is sufficient.

Before implementation, read the threat-model procedure; before completion, read the applicable security review and must-pass addenda.

Modular References

Condition	Reference
Before security-sensitive implementation	Threat model
Input validation, login/session/token/OAuth, authorization, or sensitive flows	Access controls
Secrets, headers/CSP/CORS, or abuse/rate limits	Runtime controls
AI-suggested dependencies, security claims/static checks, agent configuration, MCP, or sandboxing	Agent integrity and scans (SEC-ANTIPATTERN-01)
Security-sensitive completion, deploy/release, uploads/payments/logging/PII, or control ownership	Security review and ownership matrix, ASVS checklist
Any security-sensitive code	OWASP Top 10
JS/TS, Python, SQL, or Go security work	Language quirks
Before claiming code is secure	Static analysis recipes
Tool-using agents or prompt-driven flows	Agentic AI
LLMs, RAG, or tool/agent output	LLM supply chain
Add/vet MCP servers	MCP supply chain
Dependency audit or release integrity	SBOM and signing
Domain implementation, CI credential delivery/signing, frontend, testing, review, RCA, scaffolding, or pipelines	Companion owners; load the domain skill too

Read only the references relevant to the current task. A small CSS change needs no OWASP reference. Auth, data access, secrets, file uploads, webhooks, or incident response changes do.