Security Cards

Security Cards is a set of secure coding notes for popular open-source libraries. The cards are tied to specific library versions, so developers and coding agents can use guidance that matches the code they are working on.

Each card says when it applies, then gives secure rules and code examples. You can browse the cards by language, library, version, and security category.

The cards are available at securitycards.rewarelabs.com.

Important

Security Cards can help with security work, but it is not a replacement for a professional security review. Read the disclaimer for details.

Getting started

Prerequisites

• Node.js 22.12 or later
• npm

Run locally

git clone https://github.com/Reware-Labs/securitycards.git
cd securitycards
npm install
npm run dev

Open http://localhost:4321 in your browser.

Run the full set of checks with:

npm run validate

Use Security Cards as a skill

The securitycards skill lets a coding agent look up and apply cards while it works. Install it with either npx or the GitHub CLI.

With npx:

npx skills add Reware-Labs/securitycards --skill securitycards -g

With the GitHub CLI:

gh skill install Reware-Labs/securitycards securitycards --scope user

Remove -g from the npx command if you only want the skill in the current project.

Once installed, mention the skill in your prompt. It reads the project's lockfiles to find the dependency versions in use, looks for matching cards, and cites any guidance it applies. If the site does not have cards for that exact version, the skill stops instead of quietly using a different one.

Example use cases

Establish secure defaults for a new project

Use Security Cards to set secure defaults for this project.

Implement a security-sensitive feature

Use Security Cards while implementing this file-upload endpoint. Apply the relevant rules and link to the cards you used.

Review existing code

Review this authentication service using Security Cards. Only report issues you can verify in the code, and link to each card you used.

Review a specific dependency

Check how this project uses Express with Security Cards. Read the installed version from the lockfile and only use cards for that version.

The agent usage guide describes the full workflow and lists the machine-readable resources available to agents.