What problem does it solve? API responses often leak sensitive PHI/PII fields like clinical notes, OAuth tokens, risk scores, and payment identifiers through overly permissive serializers, GraphQL types, or client-side caching. This Skill audits your Django REST Framework serializers, Graphene schemas, middleware, and frontend state stores to find and fix field-level exposure violations. ## Core Features & Use Cases - Serializer Auditing: Scans DRF serializers for fields = '__all__', missing write_only flags, and SerializerMethodField leaks on PHI models, producing a field-level exposure map. - GraphQL & Middleware Checks: Verifies resolver ownership filtering, auth decorators, introspection settings, and can generate a response sanitization middleware that strips stack traces, redacts emails, and sets no-store cache headers on PHI endpoints. - Frontend Cache Review: Detects PHI persisted in Redux slices, Apollo cache, localStorage, console logs, and dangerouslySetInnerHTML XSS vectors. - Use Case: Before deploying a new telehealth feature, run the audit to confirm that Notes.notes, OAuth tokens, and provider NPI numbers are never exposed to unauthorized users, and receive a markdown exposure map with PASS/FAIL verdicts per serializer. ## Quick Start Ask the assistant to run the api-response-sanitizer skill with scope all and the fix flag to audit serializers, GraphQL, middleware, and frontend state for PHI leakage.
