What problem does it solve? Building an AI agent SaaS means handling authentication, rate limiting, injection attacks, secrets, and GDPR obligations, and missing any one of them creates real vulnerabilities. This Skill provides a structured security validation checklist with working TypeScript implementation patterns so nothing critical is overlooked before launch. ## Core Features & Use Cases - Authentication & Authorization Patterns: NextAuth/Clerk session management, route protection middleware, and API key rotation with Prisma transactions. - API Security & Injection Prevention: Upstash rate limiting, CORS configuration, Zod request validation, SQL/XSS/command injection defenses, and prompt injection sanitization for LLM inputs. - Compliance & Audit: GDPR data export and right-to-deletion endpoints, webhook signature verification (Stripe, Clerk/Svix), and security event audit logging. - Use Case: Before launching your AI chat SaaS, run through the tiered checklist (Critical / Important / Recommended) to confirm no hardcoded secrets exist, HTTPS is enforced, webhooks verify signatures, and per-user LLM token limits prevent cost abuse. ## Quick Start Ask the AI to audit your Next.js API routes against the security checklist and generate the missing rate limiting and webhook verification code.
