Imported from HoangDuc1003/Cinema-booking (skills/security-hardening/SKILL.md). Install upstream with npx skills add HoangDuc1003/Cinema-booking --skill security-hardening. Copyright stays with the author.

Harden Security

1. Search tracked files for credential patterns; report exposure without echoing values.
2. Keep secrets server-side and document placeholders only in .env.example.
3. Validate and normalize every untrusted route parameter and body field.
4. Derive booking prices and user identity server-side; never trust client totals or user IDs.
5. Verify Stripe signatures against the raw body and make callbacks idempotent.
6. Enforce ownership on pay, cancel, and read operations; enforce admin authorization on mutations.
7. Avoid returning stack traces, provider errors, connection strings, or internal identifiers unnecessarily.
8. Review CORS and origin-derived redirect URLs against an allowlist for production.
9. Add rate limiting or note it as follow-up when endpoints are abuse-sensitive.
10. Verify failure behavior for missing or unavailable Redis because security invariants must not depend solely on it.

Prioritize exploitable findings and keep remediation scoped. Re-run secret scanning and regression tests before handoff.