{
  "instruction": "Add CORS, rate limiting, security headers, and trusted hosts to FastAPI",
  "relevant_when": "Agent creates or modifies a FastAPI application, adds routes to a FastAPI app, or sets up a FastAPI project",
  "context": "Every FastAPI app needs explicit middleware for CORS, security headers, rate limiting, and trusted hosts. These are baseline requirements, not optional hardening.",
  "sources": [
    {
      "type": "file",
      "filename": "skills/fastapi-security-basics/SKILL.md",
      "tile": "tessl-labs/fastapi-security-basics@0.2.0"
    }
  ],
  "checklist": [
    {
      "name": "cors-middleware-added",
      "rule": "Agent adds CORSMiddleware with explicit allowed origins, not ['*']",
      "relevant_when": "Agent creates or modifies a FastAPI application"
    },
    {
      "name": "cors-origins-from-env",
      "rule": "Agent reads CORS allowed origins from os.getenv('ALLOWED_ORIGINS') or similar environment variable",
      "relevant_when": "Agent creates or modifies a FastAPI application"
    },
    {
      "name": "cors-explicit-methods",
      "rule": "Agent specifies allow_methods explicitly in CORSMiddleware (e.g., ['GET', 'POST', 'PATCH', 'DELETE']), not relying on defaults",
      "relevant_when": "Agent creates or modifies a FastAPI application"
    },
    {
      "name": "security-headers-middleware",
      "rule": "Agent adds an HTTP middleware that sets X-Content-Type-Options, X-Frame-Options, X-XSS-Protection, and Referrer-Policy headers on all responses",
      "relevant_when": "Agent creates or modifies a FastAPI application"
    },
    {
      "name": "trusted-host-middleware",
      "rule": "Agent adds TrustedHostMiddleware with allowed_hosts read from os.getenv('ALLOWED_HOSTS') or similar environment variable",
      "relevant_when": "Agent creates or modifies a FastAPI application"
    },
    {
      "name": "rate-limiter-configured",
      "rule": "Agent installs slowapi and creates a Limiter with get_remote_address as key_func, assigns it to app.state.limiter, and adds a RateLimitExceeded exception handler returning 429",
      "relevant_when": "Agent creates or modifies a FastAPI application"
    },
    {
      "name": "rate-limit-on-routes",
      "rule": "Agent applies @limiter.limit() decorator to API routes, with stricter limits on POST/mutation endpoints than read endpoints",
      "relevant_when": "Agent creates or modifies a FastAPI application"
    }
  ]
}