api-security-best-practices

SKILL.md

Guide developers in building secure APIs by implementing authentication, authorization, input validation, rate limiting, and protection against common vulnerabilities. This skill covers security patterns for REST, GraphQL, and WebSocket APIs.

Problem: JWT Secret Exposed in Code Symptoms: JWT secret hardcoded or committed to Git Solution: \\\`javascript // ❌ Bad const JWTSECRET = 'my-secret-key';

// ✅ Good const JWTSECRET = process.env.JWTSECRET; if (!JWTSECRET) { throw new Error('JWTSECRET environment variable is required'); }

認証、認可、入力検証、レート制限、一般的な API 脆弱性に対する保護など、安全な API 設計パターンを実装します。 ソース: poletron/custom-rules。

原文を見る