learning-badge-system
badge-system for credentials, recognition, and competency validation.
badge-system for credentials, recognition, and competency validation.
Continuous security vulnerability scanning for OWASP Top 10, common vulnerabilities, and insecure patterns. Use when reviewing code, before deployments, or on file changes. Scans for SQL injection, XSS, secrets exposure, auth issues. Triggers on file changes, security mentions, deployment prep.
Reviews code for security vulnerabilities and adherence to the project's Gate vs Policy authorization rules. Use before committing changes involving permissions or routes.
Next.js/TypeScriptプロジェクト向けセキュリティ診断スキル。OWASP準拠。 以下の場合に使用: (1) PRレビュー時のセキュリティチェック (2) API Routes のセキュリティ検証 (3) 認証・認可ロジックの確認 (4) 依存パッケージの脆弱性確認 (5) 環境変数・シークレット管理の確認
Review test cases for ID Token validation. Covers ID Token structure, required/conditional claims, signature validation (RS256), and all validation rules per OIDC Core 1.0 Section 2 and 3.1.3.7.
iOS app permissions request and management guide. When to use: when adding camera access, microphone usage, speech recognition, photo library access, or any iOS system resource requiring user authorization. What problems it solves: prevents app crashes due to missing permissions, ensures App Store approval by including proper usage descriptions, handles permission request flows properly, and manages permission denial states gracefully.
Comprehensive guide to preventing PII and secrets from appearing in logs through redaction strategies, safe logging practices, and automated filtering.
Static analysis security vulnerability scanner for Ruby on Rails applications. Use when analyzing Rails code for security issues, running security audits, reviewing code for vulnerabilities, setting up security scanning in CI/CD, managing security warnings, or investigating specific vulnerability types (SQL injection, XSS, command injection, etc.). Also use when configuring Brakeman, reducing false positives, or integrating with automated workflows.
Validate config at startup, secrets in memory only. Never read config during requests, never store secrets in env vars. Use node-env-resolver for multi-source config.