Security Cards

Security Cards is an open source collection of library-specific security guidance for developers and AI coding agents. The cards are tied to specific library versions, so developers and agents can use guidance that matches the code they are working on.

Each card says when it applies, then gives secure rules and code examples. You can browse the cards by language, library, version, and security category.

The cards are available at securitycards.rewarelabs.com.

Important

Security Cards can help with security work, but it is not a replacement for a professional security review. Read the disclaimer for details.

Use Security Cards as a skill

The securitycards skill lets a coding agent look up and apply cards while it works. Install it with either npx or the GitHub CLI.

The skill is instruction-only: it contains no executable scripts and requires no API keys. It fetches guidance from the public Security Cards catalog and cites the cards it applies.

With npx:

npx skills add Reware-Labs/securitycards --skill securitycards -g

With the GitHub CLI:

gh skill install Reware-Labs/securitycards securitycards --scope user

Remove -g from the npx command if you only want the skill in the current project.

Once installed, mention the skill in your prompt. It reads the project's lockfiles to find the dependency versions in use, looks for matching cards, and cites any guidance it applies. If the site does not have cards for that exact version, the skill stops instead of quietly using a different one.

Example use cases

Establish secure defaults for a new project

Use Security Cards to set secure defaults for this project.

Implement a security-sensitive feature

Use Security Cards while implementing this file-upload endpoint. Apply the relevant rules and link to the cards you used.

Review existing code

Review this authentication service using Security Cards. Only report issues you can verify in the code, and link to each card you used.

The agent usage guide describes the full workflow and lists the machine-readable resources available to agents.

Local development

To run the website locally or contribute changes, you will need Node.js 22.12 or later and npm.

git clone https://github.com/Reware-Labs/securitycards.git
cd securitycards
npm install
npm run dev

Open http://localhost:4321 in your browser.

Run the full set of checks with:

npm run validate