Auth Hardening
Authentication is where almost every public-facing app eventually gets attacked. The good news: a small set of patterns covers most of the threat surface, and the worst practices (password rotation every 90 days, "security questions") are actively harmful.
This skill is opinionated. The opinions track NIST SP 800-63B, OWASP ASVS, and industry consensus circa 2026.
When to invoke
- Building auth from scratch
- Reviewing an existing auth system before scaling user count
- H
[Description truncada. Veja o README completo no GitHub.]