security-best-practices
Security frameworks, accessibility guidelines, performance optimization, and code quality best practices for building secure, maintainable, and high-performance applications.
Plugin bundle · by Awesome Copilot Community
About
security-best-practices is a plugin bundle for AI coding tools published by Awesome Copilot Community. Marketplaces we read that list it: 1 (Community GitHub marketplaces). The last change we recorded was on 2026-10-20. As of our marketplace pass on 2026-10-24.
What it asks for
- Installs as a plugin bundle
None of the marketplaces we read publishes its tools or the settings it asks for.
What it declares, asks for and runs, in full
Only install plugins from developers you trust. We list what marketplaces publish and do not test plugins.
Works with
- Claude Code
From the marketplaces that list it and the MCP transport it declares, as each client documents them. We do not test plugins.
Connect
Commands and configs built only from what its marketplaces declare. We do not run them for you and do not test plugins.
As a Claude Code plugin
Built from what Community GitHub marketplaces declares.
/plugin marketplace add gbb-acelerators/awesome-harness-primitives
/plugin install security-best-practices@copilot-primitives-claudeWhere it is published
| Marketplace | Status | Version | Figures | Verified | First seen |
|---|---|---|---|---|---|
| Community marketplace gbb-acelerators/awesome-harness-primitives (Open the source on GitHub) | Listed | 1.0.2 | Forks (GitHub): 0 Stars (GitHub): 21 |
Not marked |
Each figure is the marketplace's own and is never added up across marketplaces. A marketplace that publishes no figure shows none: no number is not zero.
Listed in one community marketplace
| Marketplace | Repository | Stars (GitHub) |
|---|---|---|
| copilot-primitives-claude | gbb-acelerators/awesome-harness-primitives | 21 |
How its figures have moved
- 2026-10-2021
- 2026-10-2421
Each dot is a day we read a different number; flat stretches are days the number did not move. Figures of different marketplaces are never added up.
What the bundle contains
As published on Community GitHub marketplaces.
Skills: 1
ai-prompt-engineering-safety-review
What changed
- Became a product we track
- Community GitHub marketplaces: appeared
Forks and copies
Similar plugins
Products whose own names, descriptions, tools and skills are closest in meaning to this one, on every marketplace we read. Closeness is ranked within this list only.
-
Security frameworks, accessibility guidelines, performance optimization, and code quality best practices for building secure, maintainable, and high-performance applications.
-
Security audits, vulnerability scanning and secure coding.
-
Keep your coding agent up to date with the latest web best practices
-
Security review for Claude-generated code. Pattern-based warnings on edits, LLM-powered diff review on Stop, and an agentic commit reviewer that catches injection, XSS, SSRF…
-
Assess and harden application security: source vulnerability review, secret scanning, CodeQL scanning, STRIDE and TM7 threat models, data-breach blast radius, and GDPR engineering…
-
Security best practices and vulnerability detection
-
Security hardening and production-grade error handling expertise for Claude Code. Prevents OWASP Top 10 vulnerabilities (SQL injection, XSS, broken auth, secrets exposure) and…
-
Five practical skills covering the domains developers most often Google when shipping a website. Each skill auto-loads only when relevant to the task: Web Accessibility on UI…
-
Semgrep catches security vulnerabilities in real-time and guides Claude to write secure code from the start.
-
Universal Development Standards (v2.3.0) — A Claude Code skill that enforces production-grade engineering practices across the full SDLC.
Similar plugins by marketplace
The same question asked of one marketplace at a time: is there an analog of this plugin there?
Has a listing on Claude Code: claude-plugins-community (5)
-
Security hardening and production-grade error handling expertise for Claude Code. Prevents OWASP Top 10 vulnerabilities (SQL injection, XSS, broken auth, secrets exposure) and…
-
Five practical skills covering the domains developers most often Google when shipping a website. Each skill auto-loads only when relevant to the task: Web Accessibility on UI…
-
Semgrep catches security vulnerabilities in real-time and guides Claude to write secure code from the start.
-
Universal Development Standards (v2.3.0) — A Claude Code skill that enforces production-grade engineering practices across the full SDLC.
-
10 expert audit lenses + full-audit orchestrator + 5 bundled reference skills. Review plans and code through the eyes of Design, UX, Frontend, Backend, Structural, Repo…
Has a listing on Claude Code: claude-plugins-official (5)
-
Keep your coding agent up to date with the latest web best practices
-
Security review for Claude-generated code. Pattern-based warnings on edits, LLM-powered diff review on Stop, and an agentic commit reviewer that catches injection, XSS, SSRF…
-
Semgrep catches security vulnerabilities in real-time and guides Claude to write secure code from the start.
-
Automate API security directly in Claude Code with 42Crunch - automatically audit OpenAPI specs, detect vulnerabilities aligned with OWASP API Security risks (including…
-
Set up endorctl and use Endor Labs to scan, prioritize, and fix security risks across your software supply chain
Has a listing on Claude: knowledge-work-plugins (5)
-
Keep your coding agent up to date with the latest web best practices
-
Security review for Claude-generated code. Pattern-based warnings on edits, LLM-powered diff review on Stop, and an agentic commit reviewer that catches injection, XSS, SSRF…
-
Bring Qodo's codebase intelligence, coding standards, and code review into your coding agent.
-
Enterprise-grade auth, easy to implement. Add login, SSO, MFA, and access control to any app with framework-aware guidance.
-
AI-first project auditor and re-engineer based on the 9 design principles and 7 design patterns from the TechWolf AI-First Bootcamp
Has a listing on Codex: openai-curated (openai/plugins) (5)
-
Build web apps with frontend asset design, browser testing, UI components, payments, and database guidance.
-
Codex Security workflows for security scans, analysis, and investigation.
-
CrowdStrike Falcon Foundry development skills for building cybersecurity applications on the Falcon platform. Includes UI development, collections, functions, workflows, API…
-
Evaluate Codex skills and plugins from chat with a beginner-friendly start command, local-first reports, token budget explanations, and guided benchmarking.
-
Qodo setup, code intelligence, and review workflows.
Has a listing on Community GitHub marketplaces (5)
-
Security audits, vulnerability scanning and secure coding.
-
Keep your coding agent up to date with the latest web best practices
-
Assess and harden application security: source vulnerability review, secret scanning, CodeQL scanning, STRIDE and TM7 threat models, data-breach blast radius, and GDPR engineering…
-
Security best practices and vulnerability detection
-
Semgrep catches security vulnerabilities in real-time and guides Claude to write secure code from the start.
Has a listing on Copilot CLI: github/awesome-copilot (5)
-
Security frameworks, accessibility guidelines, performance optimization, and code quality best practices for building secure, maintainable, and high-performance applications.
-
Keep your coding agent up to date with the latest web best practices
-
7 specialized agents covering the full software development lifecycle from UX design and architecture to security and DevOps.
-
Security extension for GitHub Copilot App with a canvas to work on GHAS findings.
-
Essential prompts, instructions, and chat modes for modern frontend web development including React, Angular, Vue, TypeScript, and CSS frameworks.
Has a listing on Copilot CLI: github/copilot-plugins (5)
-
Advanced Security plugin for GitHub Copilot.
-
Bring Azure DevOps work-item, repository, and pull-request workflows into GitHub Copilot.
-
Toolkit for building Microsoft 365 Copilot declarative agents — scaffolding, JSON manifest development, and capability configuration.
-
code-apps-preview
Build and deploy Power Apps code apps using React, Vite, and Power Platform connectors.
-
Build Power Apps Canvas Apps using the Canvas Authoring MCP server.
Has a listing on Cursor: cursor/plugins (5)
-
if you want to go fast, go deep first. pstack helps you write less, but higher quality code. rigorous agent workflows you can parallelize with confidence.
-
Skills for building on the Cursor Origin API. Fetch the live spec first, then follow the Origin rules for credentials, scopes, webhooks, paging, and errors. Includes a skill that…
-
CLI-backed repo compatibility scans plus agents that audit startup, validation, and docs against reality.
-
Internal team workflows for CI, code review, shipping, local automation, and verification.
-
Build apps, scripts, and automations with the TypeScript SDK.
Has a listing on Docker MCP Catalog (5)
-
Stop stitching context for Copilot and Cursor. With Sequa MCP, your AI tools know your entire codebase and docs out of the box.
-
Tools and resources for writing Effect code in Typescript.
-
next-devtools-mcp is a Model Context Protocol (MCP) server that provides Next.js development tools and utilities for AI coding assistants.
-
MCP server for using Semgrep to scan code for security vulnerabilities.
-
Connects with the Beagle Security backend using a user token to manage applications, run automated security tests, track vulnerabilities across environments, and gain intelligence…
Has a listing on Official MCP Registry (5)
-
speclock io.github.sgroy10/speclock
AI Constraint Engine — enforces CLAUDE.md and .cursorrules as laws. 51 MCP tools.
-
Local-first MCP security scanner and CLI for AI-generated applications.
-
Agentic SDLC governance and security controls for AI coding agents working with GitHub.
-
Offline, rule-based security checks for your repo, dependencies, AI agent config and local app.
-
seocode io.github.qobitech/seocode
Framework-aware technical SEO and AI-discoverability (GEO) audits for your codebase, in your editor.
Has a listing on PyPI (MCP servers) (5)
-
codacy com.mcparmory/codacy
Analyze code quality, security issues, and coverage across repositories
-
Let one coding-agent CLI consult another: Codex, Claude Code, OpenCode, Copilot or Antigravity.
-
air-blackbox-mcp io.github.airblackbox/air-blackbox-mcp
EU AI Act compliance scanner for Python AI agents. 14 tools across 6 articles.
-
mcp-safeguard com.cognivators/mcp-safeguard
MCP server security scanner: detects prompt injection, credential leaks, SSRF, tool poisoning.
-
repo-graph io.github.James-Chahwan/repo-graph
Structural graph map of any codebase so LLMs navigate by structure, not guesswork.
Has a listing on npm registry (MCP servers) (5)
-
speclock io.github.sgroy10/speclock
AI Constraint Engine — enforces CLAUDE.md and .cursorrules as laws. 51 MCP tools.
-
Audit your Design System and serve your Agent the rules that keep AI-written UI on-system.
-
codescene-mcp-server com.codescene/codescene-mcp-server
An MCP server that provides CodeScene Code Health analysis tools.
-
AI visibility + site audits: see if ChatGPT, Perplexity, Claude & Gemini recommend a website.
-
pushci io.github.finsavvyai/pushci
AI-native zero-config CI/CD. 19 languages, 40+ frameworks. Free forever.
Found by meaning, not by shared code or a shared repository: similar plugins stay separate products, and this is not a review or a recommendation.
Want this mark on your plugin in our catalog?
Prove you maintain it with a file in its repository, a file on your domain or a DNS record, and you can show this mark on the card, with live banners for your site and README. How verification works
You also get alerts when a marketplace lists it, drops it, changes its verified mark or what it asks for, and its remote endpoint goes on monitoring as a web service.
Data comes from public marketplace files in GitHub repositories of their authors. Figures come from our own regular passes over the marketplaces, last read on . We publish no contact details for plugin publishers.