What problem does it solve? Spring Boot teams often ship authentication, authorization, tenancy, and data-protection defects because framework defaults and OWASP checklists do not prove a control actually works. This Skill provides verified security rules for every trust boundary a change crosses, from filter chains to caches, messaging, and cloud resources. ## Core Features & Use Cases - Authorization and tenancy enforcement: Defines deny-by-default filter chains, object and property scoping, and a recorded tenancy model with paired two-tenant integration tests. - Data protection and confidentiality: Classifies sensitive data, governs secrets, logs, caches, and external transfers, and prevents confidential material from leaking to unapproved tools. - Abuse prevention and verification: Covers rate limits, idempotency, webhooks, SSRF, dangerous sinks, supply chain, and a security test strategy with positive and negative scenarios. - Use Case: When adding a new REST endpoint that reads customer data, use this Skill to derive the tenant from a verified claim, scope the repository query, produce 401/403 from the filter chain, and write the paired authorization tests. ## Quick Start Review this Spring Boot change for security issues across authentication, authorization, tenancy, and data protection using the application security rules.
