How does this skill handle XSS prevention in Sinatra?

The skill provides patterns for default template escaping, manual sanitization using the Sanitize gem, and implementing strict Content Security Policy (CSP) headers.

Is it compatible with different Ruby ORMs?

It includes specific security patterns for both Sequel and ActiveRecord, focusing on parameterized queries to prevent SQL injection.

Can this skill help with rate limiting?

Yes, it provides detailed configurations for Rack::Attack to throttle login attempts and API requests based on IP or API keys.

Does it support modern API authentication?

Yes, it includes comprehensive implementations for JWT (JSON Web Tokens), API key management, and session-based authentication using BCrypt.

Sinatra Security Expert

Name: Sinatra Security Expert
Author: geoffjay

bygeoffjay

•

セキュリティとテスト

Implements industry-standard security best practices for Sinatra applications to prevent common vulnerabilities like CSRF, XSS, and SQL injection.

概要

This skill provides a comprehensive security toolkit for developers working with the Ruby Sinatra framework. It offers domain-specific guidance on hardening applications against modern web threats, implementing robust authentication and authorization patterns, and managing secure sessions. It serves as an essential companion for building production-ready Ruby apps or conducting deep security audits of existing codebases, ensuring compliance with OWASP principles and secure-by-default configurations.

主な機能

2 GitHub stars
Cross-Site Request Forgery (CSRF) protection using Rack::Protection
Granular authorization systems including Role-Based Access Control (RBAC)
Parameterized query patterns to eliminate SQL injection risks in Sequel and ActiveRecord
Comprehensive authentication patterns including BCrypt, JWT, and API Keys
Rate limiting and file upload security implementations
Advanced XSS prevention strategies and Content Security Policy (CSP) headers

ユースケース

Hardening a production Sinatra application against common web attacks
Conducting security reviews and refactoring legacy Sinatra codebases for modern compliance
Implementing multi-layered authentication and authorization for a Ruby-based REST API

概要

主な機能

2 GitHub stars
Cross-Site Request Forgery (CSRF) protection using Rack::Protection
Granular authorization systems including Role-Based Access Control (RBAC)
Parameterized query patterns to eliminate SQL injection risks in Sequel and ActiveRecord
Comprehensive authentication patterns including BCrypt, JWT, and API Keys
Rate limiting and file upload security implementations
Advanced XSS prevention strategies and Content Security Policy (CSP) headers

ユースケース

Hardening a production Sinatra application against common web attacks
Conducting security reviews and refactoring legacy Sinatra codebases for modern compliance
Implementing multi-layered authentication and authorization for a Ruby-based REST API