Open source alternatives to openai/security-best-practices

O

openai/security-best-practices

Review code for language-specific security vulnerabilities

security-best-practices is an agent skill from OpenAI's curated skills collection that reviews Python, JavaScript and TypeScript, and Go codebases for security vulnerabilities, using guidance specific to each language and framework. It works in three modes: writing secure-by-default code while you build, passively flagging the critical issues it sees during development, and generating a prioritized vulnerability report when you ask for one. Instead of cross-referencing OWASP material and framework advisories by hand, the skill loads the reference for your exact stack and applies it to your code. It is meant to be triggered when you explicitly ask for a security best-practice review, so it does not run on every change. Typical uses include auditing a Flask API for common Python web security issues before a production deploy, generating a severity-ranked report for a Node.js Express app, writing new Go HTTP handlers with secure defaults applied, catching hard-coded secrets or missing input validation while adding features to a TypeScript project, and getting a fix for a specific class of issue with an explanation tied to the relevant guidance. It suits developers who want a stack-aware review before release. A review is a useful aid but not a guarantee, so pair it with testing and, for sensitive systems, a dedicated security assessment. The skill is listed on officialskills.sh and installs from the openai/skills repository. Install it with npx skills add https://github.com/openai/skills --skill security-best-practices.