PACT Security Patterns Skill

PACT Security Patterns

Security guidance for PACT development phases. This skill provides essential security patterns and links to detailed references for comprehensive implementation.

SACROSANCT Rules (Non-Negotiable)

These rules are ABSOLUTE and must NEVER be violated.

Rule 1: Credential Protection

NEVER ALLOW in version control:

Actual API keys, tokens, passwords, or secrets
Credentials in frontend code (VITE_, REACT_APP_, NEXT_PUBLIC_ prefixes)
Real credential values in documentation or code examples
Hardcoded secrets in any file committed to git

ONLY acceptable locations for actual credentials:

| Location | Example | Security Level | |----------|---------|----------------| | .env files in .gitignore | API_KEY=sk-xxx | Development | | Server-side process.env | process.env.API_KEY | Runtime | | Deployment platform secrets | Railway, Vercel, AWS | Production | | Secrets managers | Vault, AWS Secrets Manager | Enterprise |

In Documentation - Always Use Placeholders:

# Configuration
Set your API key in `.env`:
API_KEY=your_api_key_here

Rule 2: Backend Proxy Pattern

WRONG:  Frontend --> External API (credentials in frontend)
CORRECT: Frontend --> Backend Proxy --> External API

Architecture Requirements:

Frontend MUST NEVER have direct access to API credentials
ALL API credentials MUST exist exclusively on server-side
Frontend calls backend endpoints (/api/resource) without credentials
Backend handles ALL authentication with external APIs
Backend validates and sanitizes ALL requests from frontend

Verification Checklist:

# Build the application
npm run build

# Search for exposed credentials in bundle
grep -r "sk-" dist/assets/*.js
grep -r "api_key" dist/assets/*.js
grep -r "VITE_" dist/assets/*.js
# All above should return NO results

Quick Security Reference

Input Validation

Always validate on the server side:

// Express.js example
const { body, validationResult } = require('express-validator');

app.post('/api/user',
  body('email').isEmail().normalizeEmail(),
  body('name').trim().escape().isLength({ min: 1, max: 100 }),
  body('age').isInt({ min: 0, max: 150 }),
  (req, res) => {
    const errors = validationResult(req);
    if (!errors.isEmpty()) {
      return res.status(400).json({ errors: errors.array() });
    }
    // Process validated input
  }
);

Output Encoding

Prevent XSS by encoding output:

// React (automatic encoding)
return <div>{userInput}</div>; // Safe - React escapes

// Dangerous - avoid unless absolutely necessary
return <div dangerouslySetInnerHTML={{__html: userInput}} />; // UNSAFE

// Node.js HTML response
const escapeHtml = (str) => str
  .replace(/&/g, '&amp;')
  .replace(/</g, '&lt;')
  .replace(/>/g, '&gt;')
  .replace(/"/g, '&quot;')
  .replace(/'/g, '&#039;');

SQL Injection Prevention

Always use parameterized queries:

// WRONG - SQL Injection vulnerable
const query = `SELECT * FROM users WHERE id = ${userId}`;

// CORRECT - Parameterized query
const query = 'SELECT * FROM users WHERE id = $1';
const result = await db.query(query, [userId]);

// ORM example (Prisma)
const user = await prisma.user.findUnique({
  where: { id: userId }  // Safe - Prisma handles escaping
});

Authentication Security

Password Storage:

const bcrypt = require('bcrypt');

// Hashing password
const saltRounds = 12;  // Minimum recommended
const hashedPassword = await bcrypt.hash(password, saltRounds);

// Verifying password
const isValid = await bcrypt.compare(password, hashedPassword);

Session Configuration:

app.use(session({
  secret: process.env.SESSION_SECRET,  // Strong, random secret
  resave: false,
  saveUninitialized: false,
  cookie: {
    secure: true,       // HTTPS only
    httpOnly: true,     // No JavaScript access
    sameSite: 'strict', // CSRF protection
    maxAge: 3600000     // 1 hour
  }
}));

Security Headers

Essential HTTP headers:

const helmet = require('helmet');

app.use(helmet({
  contentSecurityPolicy: {
    directives: {
      defaultSrc: ["'self'"],
      scriptSrc: ["'self'"],
      styleSrc: ["'self'", "'unsafe-inline'"],
      imgSrc: ["'self'", "data:", "https:"],
      connectSrc: ["'self'"],
      frameSrc: ["'none'"],
      objectSrc: ["'none'"]
    }
  },
  hsts: {
    maxAge: 31536000,
    includeSubDomains: true
  }
}));

Rate Limiting

Protect against abuse:

const rateLimit = require('express-rate-limit');

// General API rate limit
const apiLimiter = rateLimit({
  windowMs: 15 * 60 * 1000, // 15 minutes
  max: 100,
  message: { error: 'Too many requests, please try again later' }
});

// Stricter limit for auth endpoints
const authLimiter = rateLimit({
  windowMs: 60 * 60 * 1000, // 1 hour
  max: 5,
  message: { error: 'Too many login attempts' }
});

app.use('/api/', apiLimiter);
app.use('/api/auth/', authLimiter);

Security Checklist

Before any commit or deployment, verify:

Credential Protection

[ ] No credentials in staged files (git diff --staged | grep -i "key\|secret\|password")
[ ] .env files listed in .gitignore
[ ] Placeholders used in all documentation
[ ] No hardcoded API keys in source code

Architecture

[ ] Frontend makes NO direct external API calls with credentials
[ ] Backend proxy pattern implemented for all external integrations
[ ] All credentials loaded from environment variables

Input/Output

[ ] All user inputs validated server-side
[ ] SQL queries use parameterized statements
[ ] HTML output properly encoded
[ ] File uploads validated for type and size

Authentication

[ ] Passwords hashed with bcrypt (12+ rounds)
[ ] Sessions configured with secure flags
[ ] Authentication endpoints rate-limited
[ ] JWT tokens have short expiration

Headers and Transport

[ ] Security headers configured (use Helmet.js or equivalent)
[ ] HTTPS enforced in production
[ ] CORS configured restrictively

Detailed References

For comprehensive security guidance, see:

OWASP Top 10 Mitigations: references/owasp-top-10.md
- Detailed vulnerability descriptions
- Code examples for each mitigation
- Testing approaches
Authentication Patterns: references/authentication-patterns.md
- JWT implementation
- Session management
- OAuth 2.0 flows
- Multi-factor authentication
Data Protection: references/data-protection.md
- Encryption at rest and in transit
- PII handling requirements
- GDPR compliance patterns
- Key management

Agent Skills: PACT Security Patterns

Install this agent skill to your local

Skill Files