security-privacy

Think Through Security & Privacy

Overview

Production guidance for protective controls. Each reference paper captures the failures that audits find late: secrets in config and logs, home-grown crypto, disabled certificate verification, PII without retention or deletion paths, and abuse protections that rate-limit the wrong dimension.

Core principle: Controls attach to data and actions, not to layers. Every secret, sensitive field, and privileged action has a lifecycle — generation, use, rotation, redaction, deletion — that must be enforced somewhere concrete.

Domain Law

NO SECURITY OR PRIVACY CHANGE WITHOUT:
1. the minimum required primary paper(s) for the control selected from the context table;
2. the asset, actor, and trust boundary named before choosing a control;
3. "Existing-codebase checks" run when changing existing protections;
4. every applicable MUST/NEVER mapped to an enforcement point, a test,
   or a documented risk-accepted exception.

When to Use

Use this skill when thinking through, reviewing, changing, or verifying:

• secrets: storage, injection, rotation, scoping, and audit;
• encryption at rest/in transit and key management;
• TLS configuration, certificate rotation, and PKI assumptions;
• crypto primitive selection: hashing, MACs, ciphers, nonce management;
• password and token hashing parameters;
• sensitive-data classification, minimization, retention, and deletion propagation;
• log/trace/error redaction and export controls;
• abuse protection: brute force, credential stuffing, enumeration, scraping, fraud;
• feature flag safety and kill switches;
• temporary and expiring data (sessions, tokens, uploads, exports);
• randomness and token generation (IDs, secrets, nonces).

When Not to Use

• Login/session/OAuth/permission flows: use auth-access.
• API-surface attack classes (injection, object-level authorization, mass assignment): use api-contracts (062 pairs here).
• Rate-limit mechanics: use resilience-flow-control (038).
• Whole-system threat models and zero-trust architecture: use system-architecture-harness.
• Untrusted code execution sandboxes for AI: use ai-agent-system-architecture.