security-audit

Name: security-audit
Availability: InStock
Author: fcalell

Identify authorization gaps and enforce ownership isolation in web API queries.

Updated Apr 5, 2023

Search Tags:#authorization #validation #ownership #patterns #web-security #security-audit

Ready to run

npx skills add https://github.com/fcalell/dotfiles --skill security-audit-fcalell

💬 Prompt for ChatGPT / Claude Chat▼

Please help me install this Agent Skill.
Skill: security-audit
Source: https://github.com/fcalell/dotfiles/tree/main/dot_claude/skills/security-audit
Command: npx skills add https://github.com/fcalell/dotfiles --skill security-audit-fcalell

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

Web applications often struggle with inconsistent security reviews, leading to authorization gaps and data exposure. This Skill provides repeatable patterns to ensure authenticated access, ownership isolation, and safe data handling during reviews.

Core Features & Use Cases

Authorization checks for protected endpoints and correct error handling to prevent resource enumeration.
Ownership/tenant isolation in queries and bulk operations to avoid cross-tenant access.
Input validation and safe query practices using schemas and parameterized queries.
Use Case: During a security audit, apply these patterns to verify endpoints, fix missing ownership filters, and produce an audit-ready checklist.

Quick Start

Audit a web API against the catalog of patterns and implement fixes in the codebase.

Frequently Asked Questions about security-audit

High-intent search queries and answers about installing and using this skill.

FAQPage Schema

How do I check for authorization gaps in a web API?▼

To check for authorization gaps in a web API, audit protected endpoints against established patterns to verify authentication, enforce ownership isolation, and ensure correct error handling prevents resource enumeration.

What is the best way to prevent cross-tenant access during bulk operations?▼

Preventing cross-tenant access during bulk operations requires applying ownership filters and tenant isolation directly within data queries to ensure users only interact with their own resources.

How do I enforce safe data handling and input validation in web services?▼

Enforce safe data handling in web services by applying schema validation for incoming inputs and using parameterized queries to prevent injection and ensure secure database interactions.

Can I use these security audit patterns for single-resource and bulk API access?▼

Yes, these security audit patterns apply to both single-resource access and bulk operations, verifying that proper authentication and ownership filters are enforced across all query types.

Why does my API expose data across different tenants despite authentication?▼

Your API exposes data across tenants because of missing ownership isolation filters in data queries, allowing authenticated users to access resources outside their tenant boundary.

When do I need to apply ownership isolation patterns in a security review?▼

Apply ownership isolation patterns during a security review when auditing web APIs and services to fix missing ownership filters and produce an audit-ready checklist for protected endpoints.