skills.rest
TylerLeonhardt
TylerLeonhardtCOMMUNITY
Explore all skills by this author →
Website𝕏@TylerLeonhardtGitHub

greenroom-security

Enforce multi-tenant access controls with auth guards, rate limiting, and CSRF protections.

Updated Feb 27, 2026
Search Tags:#authorization#security#authentication#oauth#rate-limiting#csrf#multitenancy
One-click install
npx skills add https://github.com/TylerLeonhardt/greenroom --skill greenroom-security
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: greenroom-security
Source: https://github.com/TylerLeonhardt/greenroom/tree/main/.github/skills/greenroom-security
Command: npx skills add https://github.com/TylerLeonhardt/greenroom --skill greenroom-security

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

Securing multi-tenant applications requires a reliable pattern set that enforces authentication, group-level authorization, rate limiting, CSRF protection, and safe session handling to prevent data leakage and abuse across tenants.

Core Features & Use Cases

  • Auth guard hierarchy: requireUser, requireGroupMember, requireGroupAdmin to enforce proper access.
  • Multi-tenancy isolation: strict group-scoped data access and ownership validation for mutations.
  • Rate limiting: protect login/signup and API endpoints from abuse.
  • CSRF protection and secure session cookies: defend form submissions and OAuth flows.
  • Google OAuth CSRF state handling and secure token management.

Quick Start

Apply the appropriate guards, rate limiting, and CSRF checks to your routes to start securing group-scoped resources.

Frequently Asked Questions about greenroom-security

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I enforce multi-tenant authorization for group-scoped data?▼

Multi-tenant authorization is enforced using an auth guard hierarchy—requireUser, requireGroupMember, and requireGroupAdmin—along with strict group-scoped data access and ownership validation for mutations to prevent data leakage across tenants.

What's the best way to add rate limiting to authentication endpoints?▼

Rate limiting protects login and signup endpoints from abuse by restricting request frequency. Applying rate limits to these authentication routes safeguards against brute-force attacks and endpoint abuse.

How does CSRF protection work with OAuth state verification?▼

CSRF protection secures form submissions and OAuth flows by validating state tokens during Google OAuth authentication, ensuring secure token management and preventing unauthorized cross-site requests.

Can I use this to isolate data access between tenants in a production app?▼

Yes, production-grade security patterns enforce tenant isolation through group-level permissions, authentication guards, and secure session cookies, preventing unauthorized access and abuse across tenant boundaries.

Why do I need auth guards like requireGroupAdmin for my routes?▼

Auth guards like requireGroupAdmin enforce proper access controls by verifying user roles before route execution. This hierarchy ensures only authorized administrators can access group-level administrative functions.

When do I need to apply CSRF checks and secure session cookies?▼

CSRF checks and secure session cookies are needed when handling form submissions and OAuth flows, defending against cross-site request forgery and ensuring session tokens are transmitted securely.

Related Skills

Explore More Software Engineering Skills→
musher-devmusher-dev

implementing-tenancy-patterns

Implement and audit multi-tenant database schemas with tenant-scoped tables and RBAC.

Official
Advanced
pratikpakhalepratikpakhale

convex-security-audit

Audit Convex application security for authorization, data access, and rate limiting.

Community
Advanced
ganzinnganzinn

better-auth-security-best-practices

Configure Better Auth secrets, rate limits, CSRF, origins, sessions, and OAuth encryption.

Community
Advanced
syncupsuitesyncupsuite
1

Graduated Auth Skill

Implement progressive authentication from anonymous access to full accounts.

Official
Advanced