# Skill: Security

> **Atelier source:** `domains/security/` (first-principles +
> authentication, authorization, input-validation, secrets, supply-chain)
> **Core principles:** C1 Correctness (security is correctness)
> **BA.A mapping:** cross-cutting (all 5 skills)
> **Consumer:** read this before any production submission.

## First Principles (citizen-developer-relevant subset)

- **No secrets in code, logs, URLs, or error messages.** Secrets live in
  the platform's secret store (SSM SecureString, Secrets Manager), not
  your application repo.
- **Input is validated at the boundary.** Every external input (HTTP
  body, query, header, file) is validated against a schema before
  processing.
- **Output is encoded for its context.** HTML escaping, URL encoding,
  SQL parameterization — context-appropriate, not a blanket escape.
- **Crypto uses vetted libraries.** No MD5/SHA1 for security. Use
  bcrypt/argon2 for passwords, AES-GCM for encryption.
- **Authorization is checked, not assumed.** Every request verifies the
  caller's authority to perform the action.

## Agent-Checklist Triggers (§ Security)

- No secrets in code, logs, URLs, or error messages
- Input is validated at the boundary
- Output is encoded for its context
- Crypto uses vetted libraries (no MD5/SHA1 for security)
- Authorization is checked, not assumed

## How Nova Uses This

The submission-readiness gate checks `policyPreconditions` (e.g.,
`public-ingress: false`, `encryption_enabled: true`). The security skill
tells you what the platform enforces and what your application must
enforce on its own surface. The platform enforces infrastructure-level
security (IAM scoping, ABAC, encryption-at-rest, policy-as-code via
Checkov); you enforce application-level security (input validation, output
encoding, auth checks). The Atelier MCP server (`mcp/atelier/server.py`,
P5) can validate your code against these principles agenticly — beyond
what deterministic scanners like Wiz/Checkmarx/Mend catch.