multi-tenant-security-tester

What problem does it solve?

This Skill turns tenant-isolation and authorization concerns into executable proof by designing tests that only pass when forbidden cross-tenant or cross-privilege actions are denied. It helps teams verify that security boundaries hold across APIs, search, exports, jobs, and other shared surfaces instead of assuming isolation from happy-path behavior.

Core Features & Use Cases

• Two-tenant fixture design: Seeds Tenant A and Tenant B with representative users, roles, and resource IDs so each side can attempt the other's data.
• Negative test matrix: Builds surface × actor × operation coverage for IDOR, list leakage, mass-assignment, search, AI retrieval, exports, background jobs, and support tooling.
• Leakage assertions: Checks denial semantics, error-body leaks, header leaks, and 404-versus-403 consistency to catch subtle exposure paths.
• Regression-ready output: Converts incident findings or threat-model abuse cases into permanent security test specifications with honest coverage statements.
• Use Case: Use this Skill when preparing a security-sensitive launch and you need a cross-tenant regression suite that proves unauthorized access is blocked everywhere it matters.

Quick Start

Ask the skill to design a two-tenant negative test suite that proves Tenant A cannot access Tenant B’s resources through the API, search, exports, and background jobs.