security-first-validator

Security-First Validator

Enforces security requirements for all Django REST Framework API endpoints.

Activation Triggers

This skill activates when:

• Creating API views or viewsets
• Creating serializers
• Mentioning "endpoint", "API", "view", "route"
• Writing DRF classes (APIView, ViewSet, Serializer)
• Creating URL patterns for APIs
• Discussing authentication or permissions

Security Requirements (MANDATORY)

Every API endpoint MUST have:

1. Permission Classes (REQUIRED)

from rest_framework import viewsets
from rest_framework.permissions import IsAuthenticated

class UserViewSet(viewsets.ModelViewSet):
    permission_classes = [IsAuthenticated]  # ✅ REQUIRED
    # ...

2. Serializer Validation (REQUIRED)

from rest_framework import serializers

class UserSerializer(serializers.ModelSerializer):
    class Meta:
        model = User
        fields = ['id', 'email', 'first_name']
        # NO sensitive fields exposed ✅

    def validate_email(self, value):
        # Custom validation ✅
        if not value.endswith('@company.com'):
            raise serializers.ValidationError("Must use company email")
        return value

3. No Raw SQL (REQUIRED)

# ❌ DANGEROUS
User.objects.raw(f"SELECT * FROM users WHERE id = {user_id}")

# ✅ SAFE
User.objects.filter(id=user_id)

4. Rate Limiting (REQUIRED for sensitive endpoints)

from rest_framework.throttling import UserRateThrottle

class LoginView(APIView):
    throttle_classes = [UserRateThrottle]  # ✅ REQUIRED for auth
    # ...

Validation Process

Step 1: Detect New API Endpoint

When API code is being written:

class UserViewSet(viewsets.ModelViewSet):
    queryset = User.objects.all()
    serializer_class = UserSerializer
    # Missing security! ❌

Step 2: Run Security Checklist

Verify:

1. ✅ Permission classes defined
2. ✅ Serializer has proper validation
3. ✅ No raw SQL queries
4. ✅ Rate limiting on sensitive endpoints
5. ✅ No password/token fields in serializer
6. ✅ Proper CORS configuration