skills.rest
ColbyRReichenbach
ColbyRReichenbachCOMMUNITY
Explore all skills by this author →
WebsiteGitHub

security_audit

Audit RetentionAI's backend for webhook, authentication, and tenant isolation vulnerabilities.

Updated Aug 23, 2026
Search Tags:#multi-tenant#ORM#API security#security audit#webhook#gdpr deletion#PII protection
One-click install
npx skills add https://github.com/ColbyRReichenbach/retentionAI --skill security-audit-colbyrreichenbach
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: security_audit
Source: https://github.com/ColbyRReichenbach/retentionAI/tree/main/.claude/skills/security_audit
Command: npx skills add https://github.com/ColbyRReichenbach/retentionAI --skill security-audit-colbyrreichenbach

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

Security vulnerabilities in RetentionAI's backend and misconfigurations in webhooks, authentication, and tenant isolation can lead to data exposure and financial risk. This skill provides a comprehensive security review and practical remediation guidance.

Core Features & Use Cases

  • Webhook integrity verification, token validation, and signature checks for Stripe/Shopify endpoints.
  • SQL injection prevention through ORM usage, parameterized queries, and safe JSONB handling.
  • Tight authentication and per-tenant access controls with API keys, rate limiting, and RLS enforcement.
  • PII protection, redacted logging, data deletion workflows (GDPR), and secure secrets management.
  • Security review for API design, rate limit enforcement, and multi-tenant data isolation.

Quick Start

Use this skill to perform a security audit of RetentionAI's backend, focusing on webhook verification, access controls, and tenant isolation.

Frequently Asked Questions about security_audit

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How does webhook signature verification work for Stripe and Shopify endpoints?▼

Webhook signature verification validates incoming payloads from Stripe and Shopify endpoints by checking token integrity and cryptographic signatures. This prevents unauthorized webhook processing and protects against spoofing attacks.

What is the best way to prevent SQL injection in backend APIs?▼

SQL injection prevention is achieved through ORM-based queries, parameterized statements, and safe JSONB handling. Auditing these mechanisms ensures database layers reject malicious input and maintain query integrity.

Can I use this security audit skill for GDPR deletion workflows?▼

Yes, this security audit covers GDPR deletion workflows by reviewing data deletion processes, PII redaction, and secure secrets management. It ensures compliance with privacy regulations and protects sensitive tenant data.

How do I enforce rate limiting per tenant in a multi-tenant application?▼

Rate limiting per tenant is enforced by auditing API endpoints and applying per-tenant access controls alongside API key authentication. This prevents tenant-level abuse and ensures fair resource distribution across services.

How does PII protection work during backend security reviews?▼

PII protection during security reviews involves enforcing PII redaction, redacted logging, and secure secrets management. This ensures sensitive personal data is masked and handled properly across all backend operations.

Related Skills

Explore More Software Engineering Skills→
lucasilverentandlucasilverentand
3

hono-database

Connect Hono applications to multiple databases and ORMs.

Community
Intermediate
SanctifiedOpsSanctifiedOps
3

social-signal-bot

Automate rate-limited posting and reply monitoring on X and Telegram.

Community
Intermediate
Camilo8902Camilo8902

multi-tenant-safety-checker

Enforce tenant isolation in PostgreSQL with Row Level Security policies.

Community
Advanced
SkobynSkobyn

hunt-sqli

Detect and exploit SQL injection vulnerabilities in web applications.

Community
Advanced