What problem does it solve? A working happy path is not evidence that an application is safe to ship. This Skill turns security review into a release gate: it inspects the actual implementation, tests realistic misuse paths like IDOR, injection, and webhook forgery, applies safe fixes, and retests the final tree before declaring PASS or BLOCKED. ## Core Features & Use Cases - Adversarial Release Gate: Produces a definitive PASS or BLOCKED verdict with automatic release blockers for exposed secrets, authorization bypass, injection, and unsafe uploads. - Full Attack-Surface Review: Covers secrets exposure, authentication, authorization and tenant isolation, database mutation, input/output sinks, file uploads, webhooks, deployment hardening, and dependency supply chain. - Stack-Specific Rules: Loads targeted guidance for Supabase, Firebase, Next.js, serverless platforms, Stripe, PostgreSQL/ORMs, object storage, OAuth, and AI/LLM features. - Use Case: After an AI coding agent rapidly builds a SaaS dashboard with Supabase auth and Stripe payments, run this gate before launch to test cross-tenant access, webhook signature verification, and RLS policies, then fix and retest findings. ## Quick Start Ask the agent to run the app security gate on this repository and report whether it is safe to deploy to production.
