skills.rest
0xjc65eth
0xjc65ethCOMMUNITY
Explore all skills by this author →
GitHub

security-auditor

Detects exposed secrets, insecure configs, and missing rate limits in Next.js TypeScript trading terminal codebases.

4|1|Updated Feb 12, 2026
Search Tags:#security#audit#supabase#rate-limiting#webhooks#api-keys#wallet-security
One-click install
npx skills add https://github.com/0xjc65eth/CYPHER-V3 --skill security-auditor-0xjc65eth
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: security-auditor
Source: https://github.com/0xjc65eth/CYPHER-V3/tree/main/skills/security-auditor
Command: npx skills add https://github.com/0xjc65eth/CYPHER-V3 --skill security-auditor-0xjc65eth

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

Identifies and prioritizes security risks in a Next.js TypeScript trading terminal codebase by detecting exposed secrets, insecure endpoints, missing rate limits, unsafe wallet handling, and misconfigured deployment settings before production deployment.

Core Features & Use Cases

  • Secrets Discovery: Scans source files and environment examples for exposed API keys, private keys, and hardcoded secrets and checks Git history for leaked credentials.
  • Rate Limiting & API Protection: Detects API routes lacking rate limiting, recommends Upstash/Redis patterns, and provides example enforcement code and thresholds for critical endpoints.
  • Wallet and Key Safety: Audits wallet handling for privateKey/mnemonic leakage, localStorage misuse, and enforces secure key stores and transaction simulation practices.
  • Webhook & Integration Checks: Validates Stripe webhook signature verification, recommends secure handling for third-party integrations, and flags insecure HTTP endpoints.
  • Infrastructure & Data Controls: Verifies security headers, Supabase RLS expectations for sensitive tables, input sanitization practices, and npm dependency vulnerabilities via npm audit.
  • Output: Produces an actionable, categorized audit report with Critical/High/Medium findings and remediation guidance suitable for triage and sprint planning.

Quick Start

Run the security-auditor checklist to scan the repository for exposed secrets, missing rate limits, insecure headers, unsafe wallet handling, and generate a categorized audit report.

Frequently Asked Questions about security-auditor

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I audit a Next.js trading terminal for exposed API keys and secrets?▼

To audit a Next.js trading terminal for exposed API keys, scan source files, environment examples, and Git history to detect hardcoded secrets and NEXT_PUBLIC leaks. The process identifies private keys and credentials before production deployment.

How do I check if my Supabase RLS policies and Stripe webhook signatures are secure?▼

Checking Supabase RLS policies and Stripe webhook signatures involves validating row-level security expectations for sensitive tables and verifying Stripe webhook signature validation to prevent unauthorized data access and ensure secure third-party integrations.

What is the best way to add rate limiting to unprotected API routes in a TypeScript codebase?▼

The best way to add rate limiting to unprotected API routes is detecting routes lacking enforcement and applying Upstash or Redis patterns with defined thresholds for critical endpoints to prevent abuse and ensure production readiness.

Can I scan my codebase for unsafe wallet handling and localStorage misuse?▼

Yes, you can scan your codebase for unsafe wallet handling by auditing for privateKey or mnemonic leakage and localStorage misuse, enforcing secure key stores and transaction simulation practices to prevent incident risks.

Does a security audit report include input sanitization and npm dependency vulnerability checks?▼

A security audit report includes input sanitization practices and npm dependency vulnerabilities via npm audit, producing an actionable categorized report with Critical, High, and Medium findings along with remediation guidance for triage.

Why does my production deployment fail security header and environment validation checks?▼

Production deployment security checks fail when insecure configurations and missing security headers are detected during deployment environment validation, requiring remediation to ensure production readiness and incident prevention.

Related Skills

Explore More Software Engineering Skills→
GemachDAOGemachDAO
4

gdex-ui-install-setup

Scaffold a React or Next.js project with a GDEX SDK provider.

Official
Intermediate
Scheune10-codingScheune10-coding

saas-security-checklist

Scan Next.js, Supabase, and Stripe SaaS apps for security gaps.

Community
Advanced
Ai-WhisperersAi-Whisperers

nextjs-security

Harden Next.js 15 apps with CSRF protection, rate limiting, and RLS policies.

Official
Advanced
matteocervellimatteocervelli
25

security-scanner

Scan codebases for secrets, vulnerable dependencies, and insecure patterns.

Community
Advanced