skills.rest
alfadocs
alfadocsOFFICIAL
Explore all skills by this author →
WebsiteGitHub

alfadocs-security-review

Audit AlfaDocs applications for security and privacy risks before launch.

Updated Mar 9, 2026
Search Tags:#oauth#rls#supabase#csp#gdpr#security-audit#alfadocs
One-click install
npx skills add https://github.com/alfadocs/ai-harness-instructions --skill alfadocs-security-review
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: alfadocs-security-review
Source: https://github.com/alfadocs/ai-harness-instructions/tree/main/lovable/skills/alfadocs-security-review
Command: npx skills add https://github.com/alfadocs/ai-harness-instructions --skill alfadocs-security-review

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

This Skill helps teams review an AlfaDocs-connected app before launch and catch security issues that could expose secrets, tokens, patient data, or tenant data.

Core Features & Use Cases

  • Secret and token review: Checks that credentials stay server-side and that the browser never receives AlfaDocs tokens.
  • Tenant and policy review: Verifies Supabase RLS, practice scoping, OAuth callback integrity, and webhook trust boundaries.
  • Safety and compliance review: Flags XSS, weak CSP, logging leaks, and missing consent controls before go-live.
  • Use case: Use it when a Lovable frontend and Supabase backend are about to ship and you need a final security pass that finds blockers, warnings, and exact fixes.

Quick Start

Ask me to perform a pre-ship security review of your AlfaDocs app and report blockers, warnings, and exact file-level fixes.

Frequently Asked Questions about alfadocs-security-review

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I perform a security audit on a Supabase and Lovable app before launch?▼

A pre-ship security audit reviews your Supabase backend and Lovable frontend to catch blockers and warnings. It checks server-side secret handling, browser token isolation, RLS policies, and CSP to ensure patient data stays protected before go-live.

Why does my browser receive AlfaDocs OAuth tokens during local testing?▼

If your browser receives AlfaDocs OAuth tokens, your edge functions are likely exposing secrets. A security review verifies server-side secret handling and browser token isolation to ensure credentials never leak to the client environment.

How do I verify Supabase RLS policies for multi-tenant patient data?▼

Verifying Supabase RLS for patient data requires checking practice scoping and tenant trust boundaries. A security review audits your row-level security policies, OAuth callback integrity, and webhook trust boundaries to prevent cross-tenant data exposure.

What's the best way to enforce GDPR consent controls in an AlfaDocs application?▼

The best way to enforce GDPR consent controls is a targeted safety and compliance review. It flags missing consent enforcement mechanisms, logging leaks, and weak CSP headers, providing exact file-level fixes to achieve regulatory compliance before shipping.

Does this security review check webhook verification and origin hardening?▼

Yes, the security review checks webhook verification and origin hardening. It inspects webhook trust boundaries, validates edge function security, and verifies origin policies to block unauthorized requests from reaching your AlfaDocs application endpoints.

Can I use this audit for a Lovable frontend without a Supabase backend?▼

No, this audit is designed for Lovable frontend and Supabase backend projects using OAuth and edge functions. Without Supabase, it cannot verify RLS policies, tenant scoping, or database-level trust boundaries required for AlfaDocs patient-data workflows.

Related Skills

Explore More Software Engineering Skills→
maneeshanifmaneeshanif

fastapi-setup

Scaffold FastAPI backends with UV, SQLModel, Alembic, and testing.

Community
Advanced
doanchienthangdevdoanchienthangdev
4

security-hardening

Implements zero-trust architecture, Vault secret management, CSP headers, and audit logging for web applications.

Community
Advanced
alfadocsalfadocs

alfadocs-logic-review

Review AlfaDocs integration code for business-logic and data-flow correctness.

Official
Advanced
ammonsdammonsd

security-audit

Audit the ActivityTracking application for security vulnerabilities and generate a findings report.

Community
Advanced