Stats
Actions
Tags
How this command is triggered — by the user, by Claude, or both
Slash command
/dev-environment:securityThe summary Claude sees in its command listing — used to decide when to auto-load this command
# Security Guidelines ## Mandatory Security Checks Before ANY commit: - [ ] No hardcoded secrets (API keys, passwords, tokens) - [ ] All user inputs validated - [ ] SQL injection prevention (parameterized queries) - [ ] XSS prevention (sanitized HTML) - [ ] CSRF protection enabled - [ ] Authentication/authorization verified - [ ] Rate limiting on all endpoints - [ ] Error messages don't leak sensitive data ## Secret Management ## Security Response Protocol If security issue found: 1. STOP immediately 2. Use **boris** agent 3. Fix CRITICAL issues before continuing 4. Rotate any expose...
Before ANY commit:
// NEVER: Hardcoded secrets
const apiKey = "sk-proj-xxxxx"
// ALWAYS: Environment variables
const apiKey = process.env.OPENAI_API_KEY
if (!apiKey) {
throw new Error('OPENAI_API_KEY not configured')
}
If security issue found:
npx claudepluginhub arosenkranz/claude-code-config --plugin dev-environment/securityRuns autonomous security audit using STRIDE threat model, OWASP Top 10, and red-team simulation with 4 adversarial personas. Supports --diff, --fix, --scope, --depth flags.
/securityRuns an enhanced multi-LLM security audit with adversarial techniques, dispatching to external providers for a thorough review beyond Claude-native capabilities.
/securityConducts security reviews of apps, APIs, scripts, and configs using OWASP Top 10 best practices and threat modeling; detects vulnerabilities and suggests fixes.
/securityRuns local security review on git changes vs base branch (default: main), scanning for OWASP Top 10 vulnerabilities, secrets exposure, and anti-patterns. Outputs PASS/WARN/CRITICAL_FAIL verdict, findings, and JSON.
/securityAudits API specifications against OWASP API Security Top 10, checking for auth gaps, exposed secrets, weak validation, and transport issues. Works with local OpenAPI specs and Postman collections.
/securityAuto-detects Drupal or Next.js project type and runs multi-layer security scans with Semgrep, Trivy, Gitleaks, and more. Produces JSON report and Markdown summary grouped by severity with remediation guidance.