What problem does it solve? Releasing a Privy-enabled Solana DApp to production involves many security gates—dashboard settings, CSP headers, CORS origins, and app ID promotion—that are easy to miss and dangerous to get wrong. This Skill turns that release process into an explicit, evidence-based checklist so no gate is silently skipped. ## Core Features & Use Cases - Privy dashboard gating: Verifies allowed domains, email OTP, MFA, session duration, and embedded Solana wallet settings against official Privy security guidance. - CSP and anti-clickjacking enforcement: Requires an enforced Content-Security-Policy header, frame-ancestors 'none', and X-Frame-Options on every production route. - CORS and AWS edge validation: Checks Terraform web_origins, WEB_ORIGIN, and worker CORS origins against the exact player-web origin list with deny-by-default smoke tests. - Use Case: Before promoting a new build of the player web app to Vercel production, run this Skill to confirm the production Privy app ID is set on the Production scope only, then verify CSP, CORS, and wallet flows on the live domain. ## Quick Start Ask the AI to run the Privy production release gate checklist for the upcoming Vercel and AWS deployment and report each gate as passed, failed, or not verifiable.
