What problem does it solve? Security reviews of a multi-tenant NestJS/Next.js application often miss stack-specific risks like cross-tenant data leaks, PII in logs, or weak authorization boundaries. This Skill provides a structured audit framework tailored to the iWana neXt stack so findings are prioritized, actionable, and grounded in the real architecture. ## Core Features & Use Cases - Stack-Focused Audit Scope: Reviews authentication, authorization, tenancy isolation, OpenAPI contracts, logging, persistence, and async jobs against OWASP guidance and internal governance rules. - Zero-Trust PII and Tenancy Checks: Verifies absence of PII and secrets in code, tests, and logs, and validates schema-level tenant isolation and bounded-context boundaries. - Prioritized Findings and Escalation: Classifies findings by severity, business impact, and merge-blocking status, with a defined escalation path to the CTO for critical vulnerabilities. - Use Case: Before merging a pull request that adds a new public endpoint, run this audit to confirm input validation, tenant resolution, authorization checks, and audit trail coverage, then receive a severity-ranked findings report with corrective actions. ## Quick Start Ask the AI to audit the current pull request for security risks covering tenancy isolation, PII exposure, and OWASP controls, and return prioritized findings with merge conditions.
