Security fundamentals and best practices
This skill inherits all available tools. When active, it can use any tool Claude has access to.
Multiple layers of security controls:
Grant minimum permissions necessary:
Systems should be secure without additional configuration:
// CORRECT - Validate all input
public void processOrder(OrderRequest request) {
Objects.requireNonNull(request, "Request cannot be null");
validateOrderId(request.getOrderId());
validateAmount(request.getAmount());
// Process...
}
// WRONG - Trusting input
public void processOrder(OrderRequest request) {
repository.findById(request.getOrderId()); // SQL injection risk
}
// Headers for authentication only
@RequestHeader("X-Violet-Token") String token // Auth verification
@RequestHeader("X-Violet-App-Id") Integer appId // Auth context
// Path parameters for resource identification
@PathVariable("app_id") Integer targetAppId // Database queries
// Controller level
@PreAuthorize("hasRole('ADMIN')")
public ResponseEntity<?> adminEndpoint() { }
// Service level
if (!userService.canAccessResource(userId, resourceId)) {
throw new AccessDeniedException();
}
// Data level (row-level security)
repository.findByIdAndAppId(id, authenticatedAppId);
// Log security events
logger.info("Authentication successful",
Map.of("userId", userId, "ip", clientIp));
logger.warn("Failed login attempt",
Map.of("username", username, "ip", clientIp, "attempts", attemptCount));
// Never log sensitive data
// WRONG: logger.info("Token: " + token);
| Risk | Mitigation |
|---|---|
| Injection | Parameterized queries, input validation |
| Broken Auth | Strong session management, MFA |
| Sensitive Data | Encryption, access controls |
| XXE | Disable external entities |
| Broken Access | Authorization at every layer |
| Security Misconfig | Secure defaults, hardening |
| XSS | Output encoding, CSP |
| Insecure Deserialization | Validate before deserializing |
| Vulnerable Components | Dependency scanning |
| Insufficient Logging | Comprehensive audit logs |