skills.rest
alfadocs
alfadocsOFFICIAL
Explore all skills by this author →
WebsiteGitHub

alfadocs-architecture-review

Audits AlfaDocs app architecture for security and tenant-isolation defects in Lovable and Supabase apps.

Updated Mar 9, 2026
Search Tags:#rls#security audit#supabase#multi-tenancy#architecture review#bff#alfadocs
One-click install
npx skills add https://github.com/alfadocs/ai-harness-instructions --skill alfadocs-architecture-review
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: alfadocs-architecture-review
Source: https://github.com/alfadocs/ai-harness-instructions/tree/main/lovable/skills/alfadocs-architecture-review
Command: npx skills add https://github.com/alfadocs/ai-harness-instructions --skill alfadocs-architecture-review

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

This Skill helps you audit an AlfaDocs app’s architecture before release so you can catch security, tenancy, and session-design mistakes that would expose secrets or break isolation.

Core Features & Use Cases

  • BFF Boundary Review: Checks that the browser never calls AlfaDocs directly and that all sensitive requests flow through Supabase Edge Functions.
  • Secrets and Session Audit: Verifies that tokens, secrets, and cookies stay server-side and are handled in a way that protects users from leakage.
  • Multi-Tenancy and RLS Validation: Reviews practiceId propagation, row-level security, and cross-practice access risks in Supabase-backed AlfaDocs apps.
  • Use Case: Use this when asking whether a Lovable plus Supabase AlfaDocs app is built correctly, especially before shipping or during a security review.

Quick Start

Review the AlfaDocs app architecture and report any blockers, warnings, and notes against the BFF, session, tenancy, and RLS checklist.

Frequently Asked Questions about alfadocs-architecture-review

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I audit a Supabase multi-tenancy architecture for RLS and security leaks?▼

To audit a Supabase multi-tenancy architecture, you review practiceId propagation and verify row-level security policies to prevent cross-practice access risks. This process validates tenant isolation boundaries before release.

What is a BFF boundary review and how does it secure secrets in Lovable apps?▼

A BFF boundary review checks that the browser never calls backend APIs directly, ensuring sensitive requests flow through Supabase Edge Functions. This keeps tokens, secrets, and session cookies server-side to prevent leakage.

How do I check session cookies and CSRF protections before shipping an AlfaDocs app?▼

You check session cookies and CSRF protections by auditing the browser-to-AlfaDocs boundaries. This verifies that server-side secret handling and CORS configurations correctly protect users from malicious requests.

Does this architecture review work with Lovable and Supabase Edge Functions?▼

Yes, this architecture review applies directly to Lovable and Supabase applications. It evaluates Supabase Edge Functions, validating BFF boundaries, RLS policies, and SSRF protections during pre-release correctness checks.

What are common cross-practice access risks when using practiceId in Supabase RLS?▼

Common cross-practice access risks occur when practiceId propagation fails or Supabase RLS policies are misconfigured. An architecture review identifies these tenant-isolation defects by validating row-level security enforcement across practices.

Related Skills

Explore More Software Engineering Skills→
maneeshanifmaneeshanif

fastapi-setup

Scaffold FastAPI backends with UV, SQLModel, Alembic, and testing.

Community
Advanced
IDEA-on-ActionIDEA-on-Action

supabase-helper

Automate Supabase migrations and Edge Function scaffolding with enforced RLS policies.

Official
Advanced
harnessharness
80

configure-repo-scan

Insert code scanning steps into existing Harness pipeline YAML.

Official
Intermediate
balsm-healthbalsm-health
2

exploiting-server-side-request-forgery

Automate SSRF vulnerability testing and exploitation during authorized penetration tests.

Official
Advanced