security-best-practices

Enforce RBAC, CSRF protection, CSP, audit logging, and tenant isolation in Next.js applications.

Updated Dec 26, 2025

Search Tags:#security #rbac #nextjs #csp #csrf #audit-logging #tenant-isolation

Ready to run

npx skills add https://github.com/dthompsonfl/crispy-fishstick --skill security-best-practices-dthompsonfl

💬 Prompt for ChatGPT / Claude Chat▼

Please help me install this Agent Skill.
Skill: security-best-practices
Source: https://github.com/dthompsonfl/crispy-fishstick/tree/main/.agent/skills/security-best-practices
Command: npx skills add https://github.com/dthompsonfl/crispy-fishstick --skill security-best-practices-dthompsonfl

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

Implement enterprise-grade security for Next.js applications by enforcing RBAC, CSRF protection, CSP, audit logging, and tenant isolation.

Core Features & Use Cases

RBAC-based server-side permission checks
CSRF protection and token management
Nonce-based Content Security Policy
Comprehensive audit logging with sensitive data redaction
Tenant isolation with automatic scoping
Use Cases: Admin portals, multi-tenant APIs, and compliant systems

Quick Start

Implement an admin API endpoint with RBAC, CSRF, and audit logging following the patterns in the guide.

Frequently Asked Questions about security-best-practices

High-intent search queries and answers about installing and using this skill.

FAQPage Schema

How do I implement RBAC and tenant isolation in a multi-tenant Next.js application?▼

RBAC and tenant isolation in Next.js are enforced through server-side permission checks and automatic tenant scoping, ensuring data isolation for multi-tenant environments without manual context passing.

What's the best way to set up nonce-based Content Security Policy headers in Next.js?▼

Setting up a nonce-based Content Security Policy in Next.js involves generating unique tokens for each request to prevent cross-site scripting attacks while maintaining strict CSP compliance.

How does CSRF protection and token management work for Next.js API endpoints?▼

CSRF protection for Next.js API endpoints works by validating request origins and managing secure tokens, ensuring that state-changing API requests are intentionally submitted by authenticated users.

Can I use this approach to secure admin portals and multi-tenant APIs in Next.js?▼

Yes, this approach is specifically designed to secure admin portals and multi-tenant APIs in Next.js by combining RBAC, request validation, and redactable audit logging for compliant systems.

How do you handle audit logging with sensitive data redaction in Next.js?▼

Audit logging with sensitive data redaction in Next.js captures comprehensive user activity trails while automatically scrubbing sensitive information, meeting security compliance requirements for enterprise systems.