Audit authentication and tenant-isolation failures in multi-organization systems.
npx skills add https://github.com/hanzlahabib/rcode --skill rcode-auth-audit
Please help me install this Agent Skill. Skill: rcode-auth-audit Source: https://github.com/hanzlahabib/rcode/tree/main/rcode/skills/core/rcode-auth-audit Command: npx skills add https://github.com/hanzlahabib/rcode --skill rcode-auth-audit
This Skill helps catch subtle authentication and authorization failures before they become production incidents, such as stale sessions, broken sync, and tenant data leakage.
Ask the assistant to audit the authentication flows in your project and produce a line-by-line checklist of sync, JWT, session, and tenant-isolation risks.
High-intent search queries and answers about installing and using this skill.
Preventing cross-tenant data leakage requires enforcing tenant_id constraints using Postgres row-level security or middleware. An audit reviews your access patterns and session isolation to ensure multi-tenant data remains restricted to its organization.
Ghost sessions and disappearing users during identity sync usually stem from broken token revocation and missing session invalidation rules. Verifying Keycloak and Active Directory synchronization behavior ensures dynamic JWKS validation and explicit logout protocols are enforced correctly.
Auditing JWT validation and session lifecycle flows involves checking login, refresh, logout, and password reset processes for security gaps. A thorough review verifies dynamic JWKS validation, explicit session invalidation, and proper token revocation behavior across all authentication surfaces.
Yes, you can use this to check Postgres row-level security and tenant_id enforcement. It reviews your database access patterns to verify that RLS policies and middleware constraints are actively preventing cross-tenant reads and writes in multi-organization systems.
The best way to catch authentication drift is through periodic sync verification and dynamic JWKS validation. Reviewing identity synchronization behavior, token revocation rules, and session invalidation logic helps identify stale sessions and broken authorization flows before users notice.
vecearEnforce tenant isolation with PostgreSQL Row Level Security and automated tests.
dr-codeImplement NextAuth v5 authentication and authorization for Next.js applications.
nguyenpv1980-wqAudit Postgres row-level security policies for tenant isolation failures.
blamejsAudit multitenant isolation and denial of service resilience controls.
