cliprace-security-reviewer

To review API routes for CSRF protection and authorization flaws, analyze server actions and route handlers to ensure message authorization checks are active and rate limiting is properly keyed by userId, ip, and user-agent.

Rate limiting keyed by userId and ip works by combining user identifiers with network data and user-agent strings to enforce request thresholds, preventing abuse across API routes and server actions even when individual identifiers are spoofed.

Checking Supabase RLS policy alignment involves verifying that row-level security rules match the message authorization logic in your server actions, ensuring unauthorized users cannot bypass frontend restrictions to access restricted data.

The best way to audit payment processing webhooks for security vulnerabilities is to review the route handler file directly, verifying CSRF tokens, authorized access controls, and strict rate limiting to mitigate unauthorized exploits.

Yes, the security review process works on utility files outside of API routes by evaluating them alongside server actions to identify cross-functional vulnerabilities, ensuring consistent authorization and rate limiting enforcement across the codebase.