skills.rest
ArthurZizumbo
ArthurZizumboCOMMUNITY
Explore all skills by this author →
GitHub

portal-security-audit

Runs pre-PR and pre-deploy security audits for a FastAPI financial data portal.

Updated Jul 27, 2026
Search Tags:#fastapi#jwt#security audit#rbac#gitleaks#pre-deploy checklist#endpoint scopes
One-click install
npx skills add https://github.com/ArthurZizumbo/karisma-data --skill portal-security-audit-arthurzizumbo
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: portal-security-audit
Source: https://github.com/ArthurZizumbo/karisma-data/tree/main/.claude/skills/portal-security-audit
Command: npx skills add https://github.com/ArthurZizumbo/karisma-data --skill portal-security-audit-arthurzizumbo

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill requires gitleaks, pip-audit, ruff.

What problem does it solve? Auth-related pull requests and deployments often ship with missing endpoint scopes, leaked secrets, or permission matrix gaps. This Skill enforces a non-negotiable security checklist for the Portal Centralizado de Datos Financieros so no insecure change reaches production. ## Core Features & Use Cases - Scope Coverage Verification: Greps all FastAPI routers to confirm every data endpoint uses Security(get_current_user, scopes=[...]) and blocks PRs with unprotected endpoints. - Leakage & Dependency Scans: Runs gitleaks, pip-audit, pnpm audit, and ruff --select=S, plus greps for passwords or raw prompts in logs and response models. - Auth Rule Enforcement: Validates the 401/403 permission matrix across 4 roles, admin self-demotion protection (409), dummy-hash anti-timing login, httpOnly JWT cookies, and the R11 scope creep guard. - Use Case: Before merging an auth-related PR, run the audit to confirm 100% endpoint scope coverage, a clean secrets scan, and a passing role-based permission matrix. ## Quick Start Run the portal security audit on the current branch and report any checklist items that fail before I merge this PR.

Frequently Asked Questions about portal-security-audit

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I verify all FastAPI endpoints require authentication scopes?▼

Grep the API routers for Security(get_current_user, scopes=[...]) and diff the file list against all routers, excluding auth.py, __init__, and healthz. Any data endpoint missing scopes fails the audit and blocks the PR.

How to prevent timing attacks on a login endpoint?▼

Verify the password against a precomputed dummy hash when the username does not exist, so response time never reveals valid usernames. The audit checks that authentication always calls password_hash.verify regardless of user existence.

What tools scan a repo for leaked secrets before deployment?▼

The audit runs gitleaks detect with redaction to find committed secrets, plus grep checks for passwords and raw prompts in logs. It also runs pip-audit and pnpm audit for dependency CVEs and ruff --select=S for security linting.

Why should JWTs be stored in httpOnly cookies instead of localStorage?▼

httpOnly cookies are inaccessible to JavaScript, preventing token theft via XSS attacks, while localStorage tokens are readable by any injected script. The audit enforces httpOnly cookie storage plus CORS restricted to known frontend origins.

What features are explicitly out of scope for this security MVP?▼

Refresh tokens, password recovery flows, external OAuth/SSO, and PostgreSQL row-level security are rejected under the R11 scope guard. The MVP uses 30-minute token expiration with clean re-login, admin-managed password resets, and endpoint-level RBAC scopes.

Related Skills

Explore More Software Engineering Skills→
vanman2024vanman2024
10

fastapi-auth-patterns

Implement JWT, OAuth2, and RBAC authentication patterns in FastAPI applications.

Community
Advanced
bitpantrybitpantry

finish-pr

Merge reviewed GitHub pull requests after tests pass and branches sync.

Community
Advanced
vecearvecear

rbac-policy-tester

Automate RBAC permission validation across roles, resources, and actions.

Community
Advanced
jinyimeng01jinyimeng01
54

oauth-sso

Analyze OAuth 2.0 and SSO authentication implementations for security weaknesses during penetration tests.

Community
Advanced