Show HN: Guide AI coding agents on how to use libraries securely

Uh oh! There was an error while loading. Please reload this page. Notifications You must be signed in to change notification settings Fork 0 Star 0 BranchesTags Open more actions menu Folders and files NameName Last commit message Last commit date Latest commit History 5 Commits 5 Commits .github .github data data functions functions public public scripts scripts skills/securitycards skills/securitycards src src tests tests .env.example .env.example .gitignore .gitignore .markdownlint-cli2.jsonc .markdownlint-cli2.jsonc .node-version .node-version DISCLAIMER.md DISCLAIMER.md LICENSE LICENSE README.md README.md astro.config.mjs astro.config.mjs package-lock.json package-lock.json package.json package.json tsconfig.json tsconfig.json Repository files navigation Security Cards is a set of secure coding notes for popular open-source libraries. The cards are tied to specific library versions, so developers and coding agents can use guidance that matches the code they are working on. Each card says when it applies, then gives secure rules and code examples. You can browse the cards by language, library, version, and security category. The cards are available at securitycards.rewarelabs.com. Important Security Cards can help with security work, but it is not a replacement for a professional security review. Read the disclaimer for details. Getting started Prerequisites Node.js 22.12 or later npm Run locally git clone https://github.com/Reware-Labs/securitycards.git cd securitycards npm install npm run dev Open http://localhost:4321 in your browser. Run the full set of checks with: npm run validate Use Security Cards as a skill The securitycards skill lets a coding agent look up and apply cards while it works. Install it with either npx or the GitHub CLI. With npx: npx skills add Reware-Labs/securitycards --skill securitycards -g With the GitHub CLI: gh skill install Reware-Labs/securitycards securitycards --scope user Remove -g from the npx command if you only want the skill in the current project. Once installed, mention the skill in your prompt. It reads the project's lockfiles to find the dependency versions in use, looks for matching cards, and cites any guidance it applies. If the site does not have cards for that exact version, the skill stops instead of quietly using a different one. Example use cases Establish secure defaults for a new project Use Security Cards to set secure defaults for this project. Implement a security-sensitive feature Use Security Cards while implementing this file-upload endpoint. Apply the relevant rules and link to the cards you used. Review existing code Review this authentication service using Security Cards. Only report issues you can verify in the code, and link to each card you used. Review a specific dependency Check how this project uses Express with Security Cards. Read the installed version from the lockfile and only use cards for that version. The agent usage guide describes the full workflow and lists the machine-readable resources available to agents. Topics Resources Readme Apache-2.0 license Activity Custom properties Stars 0 stars Watchers 0 watching Forks 0 forks Report repository