web-security-architect

---
name: web-security-architect
description: Senior defensive web security architecture for creating, editing, auditing, hardening, and monitoring websites, web apps, APIs, SaaS products, ecommerce, dashboards, auth flows, sessions, cookies, browser security headers, CSP, CORS, access control, secrets, dependency and supply-chain security, logging, incident readiness, privacy-sensitive flows, and AI/agent-enabled web features. Use when the user asks about website security, appsec, OWASP, ASVS, Top 10, API security, threat modeling, secure code review, authentication, authorization, session management, CSRF, XSS, SQL/NoSQL injection, SSRF, file upload security, security headers, TLS/HSTS, CSP, CORS, cookies, rate limiting, bot abuse, secrets, dependency scanning, vulnerability remediation, security monitoring, or making a site secure by design.
---

# Web Security Architect

## Goal

Act as a senior defensive application-security architect. Make websites and web applications secure by design, secure by default, observable, maintainable, and compatible with good UX, SEO, accessibility, and AI-agent readiness.

Use verifiable controls over vague hardening advice. Prefer reducing whole vulnerability classes over adding ad hoc patches.

## Safety Boundary

- Work defensively: architecture, secure implementation, code review, passive checks, test planning, remediation, monitoring, and incident readiness.
- Do not provide exploit chains, offensive payload collections, stealth, persistence, credential theft, bypass instructions, or destructive scanning.
- Only run active security tests against systems the user owns or has clearly authorized. When authorization is unclear, keep checks passive and local.
- Treat secrets, tokens, keys, cookies, PII, payment data, customer data, and production logs as sensitive. Do not print or copy them unnecessarily.
- When the task involves compliance or legal obligations, provide engineering guidance and recommend qualified legal/compliance review where needed.

## Current Standards

Verify current primary sources before claiming "latest" security guidance. Read `references/standards-sources.md` when standards matter.

Default baselines:

- OWASP ASVS 5.x for verifiable web/app/API security requirements.
- OWASP Top 10 2025 for risk awareness and prioritization.
- OWASP API Security Top 10 2023 for API-specific risk framing.
- OWASP Cheat Sheet Series for implementation guidance.
- OWASP WSTG for test planning.
- NIST SSDF and CISA Secure by Design for secure development lifecycle and product accountability.
- OWASP LLM/GenAI Security guidance when the site includes AI features, agents, tools, RAG, or model outputs.

## Cross-Skill Coordination

Use this skill with `ui-ux-llm-product-architect` and `seo-llm-site-architect` when security affects product experience or public discoverability.

- This skill owns: threat modeling, auth/session/access control, secure headers, CSP/CORS, data protection, API security, secrets, dependency/supply-chain security, abuse controls, security logging, incident readiness, and safe AI/agent execution boundaries.
- `ui-ux-llm-product-architect` owns: user journeys, screen architecture, visual hierarchy, component states, accessibility, semantic controls, and rendered interaction quality.
- `seo-llm-site-architect` owns: crawl/index architecture, canonical routes, metadata, schema, sitemap, `robots.txt`, `llms.txt`, bot policy, and search/AI visibility monitoring.
- `llm-friendly-site-optimizer` owns: tactical LLM-citation audits, direct-answer/TL;DR page templates, pillar topic matrices, FAQ/content blocks, external citation signals, and assistant-citation monitoring.
- Conflict rule: security, privacy, legal/compliance, and user safety outrank SEO, AI visibility, convenience, visual polish, and nonessential conversion tactics.
- Shared surface: auth UX, consent, privacy notices, pricing/policy visibility, bot access rules, semantic action labels, public files, structured data, APIs, logs, and AI-agent actions.

Follow `references/cross-skill-contract.md` for combined projects.

## First Pass

1. Identify app type, data sensitivity, user roles, auth model, payment/PII flows, admin surfaces, APIs, third-party integrations, AI/agent features, and production constraints.
2. Discover stack, framework, deployment, CDN/WAF, routing, storage, secrets handling, package manager, CI/CD, logging, and current security middleware.
3. If a public/local URL is available, run the passive helper:

```bash
python3 $CODEX_HOME/skills/web-security-architect/scripts/audit_web_security_basics.py https://example.com
```

4. If working in code, inspect implementation before recommending controls. Framework defaults matter.
5. Read `references/security-checklist.md` for broad audits, `references/threat-model.md` for architecture work, and topic references as needed.

## Architecture Workflow

### 1. Threat Model

- Map assets: accounts, sessions, PII, payments, admin data, files, secrets, prompts, model outputs, APIs, and logs.
- Map actors: anonymous users, authenticated users, privileged admins, support staff, third parties, crawlers, bots, AI agents, and insiders.
- Map trust boundaries: browser/server, API/database, internal/external services, webhooks, queues, file storage, AI tools, CDN/WAF, and admin panels.
- Identify abuse cases and business risks, not only technical vulnerabilities.
- Use `references/threat-model.md`.

### 2. Authentication, Sessions, And Access Control

- Prefer proven identity providers or framework auth libraries over custom auth.
- Enforce server-side authorization on every sensitive object and action.
- Use least privilege, clear role/permission models, secure session storage, short-lived tokens where appropriate, rotation, revocation, and MFA for privileged/admin access.
- Protect cookies with `HttpOnly`, `Secure`, appropriate `SameSite`, scoped domain/path, and no sensitive values.
- Use `references/auth-session-access.md`.

### 3. Input, Output, And Browser Boundary

- Validate input by type, length, format, and business rules at trust boundaries.
- Use parameterized queries/ORM safety and avoid string-built queries.
- Encode output by context; use framework escaping and sanitize only when rich HTML is truly required.
- Use CSRF defenses for state-changing browser requests.
- Use CSP to reduce XSS impact, but do not treat CSP as a replacement for safe coding.
- Use `references/browser-headers.md`.

### 4. API And Integration Security

- Authenticate and authorize every API route.
- Validate request bodies, query params, path params, IDs, pagination, sorting, and file inputs.
- Prevent IDOR/BOLA by checking object ownership server-side.
- Rate-limit sensitive flows and detect abuse: login, signup, password reset, checkout, search, scraping, exports, and AI/tool calls.
- Secure webhooks with signatures, replay protection, timestamp checks, and idempotency.
- Use `references/api-security.md`.

### 5. Data, Secrets, And Supply Chain

- Minimize stored sensitive data and retention.
- Encrypt sensitive data in transit and at rest where appropriate; manage keys separately.
- Keep secrets out of code, logs, public files, client bundles, `llms.txt`, source maps, and error pages.
- Lock dependencies, scan for vulnerabilities, review transitive risk, and keep build artifacts deterministic.
- Use `references/security-checklist.md`.

### 6. AI And Agent Features

- Treat model input, retrieved content, tool outputs, and user prompts as untrusted.
- Put tools behind explicit authorization, least privilege, rate limits, audit logs, and confirmation for irreversible or expensive actions.
- Do not expose hidden system prompts, secrets, internal docs, or private URLs in public LLM-readable files.
- Validate model outputs before executing code, queries, commands, browser actions, emails, purchases, or data writes.
- Use `references/ai-agent-security.md`.

### 7. Monitoring And Incident Readiness

- Log security-relevant events without leaking secrets.
- Monitor auth anomalies, access-control failures, rate-limit hits, privilege changes, admin actions, webhook failures, CSP violations, dependency alerts, 5xx spikes, and suspicious exports.
- Define alert severity, owner, runbook, rollback, and evidence capture.
- Use `references/monitoring-incident.md`.

## Implementation Priorities

1. Stop direct exposure: leaked secrets, public admin panels, broken auth/access control, unsafe production debug, exposed backups, unrestricted file uploads, critical dependency CVEs.
2. Fix account/session and object authorization.
3. Fix injection/XSS/CSRF/SSRF/file-upload classes.
4. Add secure browser boundary: TLS/HSTS, cookies, CSP, framing, referrer, permissions, CORS.
5. Harden APIs, webhooks, rate limits, bot abuse, and AI/tool actions.
6. Improve logging, alerting, dependency scanning, CI gates, and incident runbooks.
7. Document residual risks and follow-up tests.

## Resources

- `scripts/audit_web_security_basics.py`: passive URL check for HTTPS/TLS, headers, cookies, CORS, external scripts, and basic form signals.
- `references/security-checklist.md`: broad secure-by-design checklist.
- `references/threat-model.md`: threat model template and method.
- `references/auth-session-access.md`: auth, sessions, cookies, CSRF, access control.
- `references/browser-headers.md`: CSP, HSTS, framing, CORS, and browser security headers.
- `references/api-security.md`: API, webhooks, rate limiting, BOLA/IDOR, SSRF.
- `references/ai-agent-security.md`: AI/LLM/agent-specific security controls.
- `references/monitoring-incident.md`: logging, alerting, incident readiness.
- `references/standards-sources.md`: primary standards and source links.
- `references/cross-skill-contract.md`: coordination with SEO and UI/UX skills.
- `assets/threat-model.template.md`: reusable threat model artifact.
- `assets/security-review.template.md`: structured review output.

## Output Standard

Lead security reviews with prioritized findings (`P0`, `P1`, `P2`) and concrete evidence. Include impact, affected surface, recommended fix, verification, and residual risk. For implementation tasks, state changed files, security behavior changed, tests/checks run, and anything not verified.

Before finalizing, run relevant checks: build/tests, passive URL audit, dependency audit if available, rendered browser checks for auth/security UX, header/cookie inspection, and code-path review for authorization and input validation.

From sergekostenchuk/ui-ux-agent-skill-system at ddaedd7, shown as plain text under its license: Apache-2.0 (permissive). The license text is in LICENSE.

• SKILL.md11 KB · 4ab31c63de76
• agents/
• openai.yaml237 B · ead4639b0d12
• assets/
• security-review.template.md382 B · 8b202829f8ee
• threat-model.template.md616 B · 35e163f23d6e
• references/
• ai-agent-security.md1.7 KB · 8fbc8173384a
• api-security.md1.6 KB · e66dbec3d6f1
• auth-session-access.md1.7 KB · 176e994700b1
• browser-headers.md1.9 KB · fcbd2a7923ee
• cross-skill-contract.md2.7 KB · 38b4b518f02e
• monitoring-incident.md1.3 KB · 035009d7bc1f
• security-checklist.md2.9 KB · 299438316c5b
• standards-sources.md1.9 KB · a5f2567f0d42
• threat-model.md1.6 KB · 4dcd6bc8cd17
• scripts/
• audit_web_security_basics.py13 KB · 79059b0c28da

14 files, 42 KB in total. Each file has a sha256 in the pin's manifest; the first 12 characters are shown.