What problem does it solve? Backend code often ships with critical vulnerabilities that linters miss: cross-tenant data leaks from service-role database clients, API endpoints without authentication checks, unvalidated webhook signatures, and sensitive fields leaking to frontend responses. This Skill applies a backend-specific threat model to detect these issues before production. ## Core Features & Use Cases - Multi-Tenancy Isolation Audit: Detects database queries using bypass clients (service_role, admin_client) that lack explicit tenant filters in their WHERE clauses. - Auth Guard Verification: Ensures every API route validates the user's session unless explicitly documented as public. - Webhook & Internal Secret Validation: Checks that endpoints consumed by external integrations (n8n, Stripe, Mercado Libre) verify secret headers or cryptographic signatures. - Frontend Leak Prevention: Flags API responses that serialize password hashes, refresh tokens, or internal metadata to the client. - Use Case: Before closing an epic on a multi-tenant SaaS, run this audit to catch a query like db.from('records').select('*') that would expose every tenant's data, triggering a critical failure that blocks release. ## Quick Start Ask the AI to run a security audit on the backend code developed in this cycle and report any critical findings in multi-tenancy isolation or authentication guards.
