What problem does it solve? Web applications handling file uploads, AI API calls, and user data often ship with exploitable gaps in authentication, upload validation, rate limiting, and secret handling. This Skill performs a threat-focused security review of the DAN IMAGES PROMPTS application, prioritizing exploitable findings over generic hardening advice. ## Core Features & Use Cases - Threat-Focused Review: Audits authentication, per-user authorization, upload validation (size, file signatures, formats), rate limits, CORS, security headers, and error disclosure. - Secret and Privacy Analysis: Checks secret handling in environment variables, logs, builds, MCP configuration, and browser bundles, plus privacy of prompts, images, and model responses. - Evidence-Based Findings: Provides file/line evidence and focused verification steps for each material finding. - Use Case: Before deploying a new upload endpoint that sends images to the Gemini API, run this Skill to verify file signature validation, rate limits, and that no API keys leak into the browser bundle. ## Quick Start Review the application for security issues around uploads, Gemini API usage, authentication, and secret handling, and report exploitable findings with file and line evidence.
