Astro Security Skill

Security patterns for lead generation sites.

Core Rules (Non-Negotiable)

| Violation | Result | |-----------|--------| | Production form without Turnstile + honeypot | FAIL | | Secret exposed client-side | FAIL | | User input stored without server validation | FAIL | | Indexable staging environment | FAIL | | Missing security headers | FAIL | | Cookie banner missing before analytics | FAIL |

Form Security (Required)

Every form must have:

| Protection | Implementation | |------------|----------------| | Turnstile | Cloudflare captcha (invisible mode) | | Honeypot | Hidden field, reject if filled | | Rate limit | Max 5 submissions/IP/hour | | Validation | Server-side Zod, never trust client | | Sanitize | Strip HTML, trim whitespace |

See references/forms.md.

Security Headers (Required)

CSP Rules:

MUST disallow inline scripts unless hashed
MUST restrict script-src to required domains only
MUST test in report-only before enforcement

Add to _headers:

X-Content-Type-Options: nosniff
X-Frame-Options: DENY
X-XSS-Protection: 1; mode=block
Referrer-Policy: strict-origin-when-cross-origin
Permissions-Policy: camera=(), microphone=(), geolocation=()
Content-Security-Policy: [see references]
Strict-Transport-Security: max-age=31536000; includeSubDomains

See references/headers.md.

Environment Variables

# .env.example (commit this)
TURNSTILE_SITE_KEY=
TURNSTILE_SECRET_KEY=
RESEND_API_KEY=
GOOGLE_SHEETS_ID=

# .env (never commit)
# Add to .gitignore

Rules:

Never expose secrets client-side
Use import.meta.env for public vars only
Validate all env vars on build

Bot Protection

Cloudflare (free tier):

Bot Fight Mode: ON
Security Level: Medium
Challenge Passage: 30 minutes

Application level:

Turnstile on all forms
Honeypot fields
Rate limiting per IP
Block empty referrer (optional)

Third-Party Scripts

Use SRI (integrity hash) for CDN scripts
Load async/defer
Minimize scripts
Review GTM tags regularly

GDPR Compliance

Required:

Cookie banner (before non-essential cookies)
Privacy policy page
Form consent checkbox (if marketing)
Data retention policy
Right to deletion process

Cookie categories: | Type | Consent | Examples | |------|---------|----------| | Necessary | No | Session, CSRF | | Analytics | Yes | GA4, Hotjar | | Marketing | Yes | Meta Pixel, Google Ads |

See references/gdpr.md.

Input Validation

Never: Trust client-side alone, store raw input, render unsanitized HTML.

See forms.md for Zod schemas.

File Uploads

If needed: Max 5MB, whitelist types, rename files, store outside webroot.

Staging Protection

Password protect OR Cloudflare Access. Add noindex, block in robots.txt.

Error Handling

Error messages MUST NOT reveal stack traces or internals
API errors MUST return generic messages (Something went wrong)
Detailed errors allowed ONLY in development
404/500 pages must not leak tech stack info

Dependencies

Minimize third-party scripts
Remove unused dependencies before launch
Review third-party access quarterly
Prefer self-hosted over CDN when possible

Definition of Done

Security requirements before launch:

[ ] Turnstile on all forms
[ ] Honeypot fields added
[ ] Rate limiting configured
[ ] Security headers set
[ ] HTTPS enforced
[ ] .env in .gitignore
[ ] No secrets in client code
[ ] Cookie banner working
[ ] Privacy policy linked
[ ] Staging protected
[ ] Error pages don't leak info

References

forms.md — Form security patterns
headers.md — CSP and headers
gdpr.md — GDPR compliance