security_audit

Audit RetentionAI's backend for webhook, authentication, and tenant isolation vulnerabilities.

Updated Aug 23, 2026

Search Tags:#multi-tenant #ORM #API security #security audit #webhook #gdpr deletion #PII protection

Ready to run

npx skills add https://github.com/ColbyRReichenbach/retentionAI --skill security-audit-colbyrreichenbach

💬 Prompt for ChatGPT / Claude Chat▼

Please help me install this Agent Skill.
Skill: security_audit
Source: https://github.com/ColbyRReichenbach/retentionAI/tree/main/.claude/skills/security_audit
Command: npx skills add https://github.com/ColbyRReichenbach/retentionAI --skill security-audit-colbyrreichenbach

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

Security vulnerabilities in RetentionAI's backend and misconfigurations in webhooks, authentication, and tenant isolation can lead to data exposure and financial risk. This skill provides a comprehensive security review and practical remediation guidance.

Core Features & Use Cases

Webhook integrity verification, token validation, and signature checks for Stripe/Shopify endpoints.
SQL injection prevention through ORM usage, parameterized queries, and safe JSONB handling.
Tight authentication and per-tenant access controls with API keys, rate limiting, and RLS enforcement.
PII protection, redacted logging, data deletion workflows (GDPR), and secure secrets management.
Security review for API design, rate limit enforcement, and multi-tenant data isolation.

Quick Start

Use this skill to perform a security audit of RetentionAI's backend, focusing on webhook verification, access controls, and tenant isolation.

Frequently Asked Questions about security_audit

High-intent search queries and answers about installing and using this skill.

FAQPage Schema

How does webhook signature verification work for Stripe and Shopify endpoints?▼

Webhook signature verification validates incoming payloads from Stripe and Shopify endpoints by checking token integrity and cryptographic signatures. This prevents unauthorized webhook processing and protects against spoofing attacks.

What is the best way to prevent SQL injection in backend APIs?▼

SQL injection prevention is achieved through ORM-based queries, parameterized statements, and safe JSONB handling. Auditing these mechanisms ensures database layers reject malicious input and maintain query integrity.

Can I use this security audit skill for GDPR deletion workflows?▼

Yes, this security audit covers GDPR deletion workflows by reviewing data deletion processes, PII redaction, and secure secrets management. It ensures compliance with privacy regulations and protects sensitive tenant data.

How do I enforce rate limiting per tenant in a multi-tenant application?▼

Rate limiting per tenant is enforced by auditing API endpoints and applying per-tenant access controls alongside API key authentication. This prevents tenant-level abuse and ensures fair resource distribution across services.

How does PII protection work during backend security reviews?▼

PII protection during security reviews involves enforcing PII redaction, redacted logging, and secure secrets management. This ensures sensitive personal data is masked and handled properly across all backend operations.