skills.rest
dthompsonfl
dthompsonflCOMMUNITY
Explore all skills by this author →
GitHub

security-best-practices

Enforce RBAC, CSRF protection, CSP, audit logging, and tenant isolation in Next.js applications.

Updated Dec 26, 2025
Search Tags:#security#rbac#nextjs#csp#csrf#audit-logging#tenant-isolation
One-click install
npx skills add https://github.com/dthompsonfl/crispy-fishstick --skill security-best-practices-dthompsonfl
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: security-best-practices
Source: https://github.com/dthompsonfl/crispy-fishstick/tree/main/.agent/skills/security-best-practices
Command: npx skills add https://github.com/dthompsonfl/crispy-fishstick --skill security-best-practices-dthompsonfl

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

Implement enterprise-grade security for Next.js applications by enforcing RBAC, CSRF protection, CSP, audit logging, and tenant isolation.

Core Features & Use Cases

  • RBAC-based server-side permission checks
  • CSRF protection and token management
  • Nonce-based Content Security Policy
  • Comprehensive audit logging with sensitive data redaction
  • Tenant isolation with automatic scoping
  • Use Cases: Admin portals, multi-tenant APIs, and compliant systems

Quick Start

Implement an admin API endpoint with RBAC, CSRF, and audit logging following the patterns in the guide.

Frequently Asked Questions about security-best-practices

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I implement RBAC and tenant isolation in a multi-tenant Next.js application?▼

RBAC and tenant isolation in Next.js are enforced through server-side permission checks and automatic tenant scoping, ensuring data isolation for multi-tenant environments without manual context passing.

What's the best way to set up nonce-based Content Security Policy headers in Next.js?▼

Setting up a nonce-based Content Security Policy in Next.js involves generating unique tokens for each request to prevent cross-site scripting attacks while maintaining strict CSP compliance.

How does CSRF protection and token management work for Next.js API endpoints?▼

CSRF protection for Next.js API endpoints works by validating request origins and managing secure tokens, ensuring that state-changing API requests are intentionally submitted by authenticated users.

Can I use this approach to secure admin portals and multi-tenant APIs in Next.js?▼

Yes, this approach is specifically designed to secure admin portals and multi-tenant APIs in Next.js by combining RBAC, request validation, and redactable audit logging for compliant systems.

How do you handle audit logging with sensitive data redaction in Next.js?▼

Audit logging with sensitive data redaction in Next.js captures comprehensive user activity trails while automatically scrubbing sensitive information, meeting security compliance requirements for enterprise systems.

Related Skills

Explore More Software Engineering Skills→
mahou-labsmahou-labs
1

organization-best-practices

Configure multi-tenant organizations, manage members and roles with Better Auth.

Official
Advanced
DeltaFoundry850DeltaFoundry850

admin-workflows

Automate secure admin CRUD operations in Next.js 16 apps.

Community
Advanced
rnavarychrnavarych
14

auth-patterns

Implement JWT, OAuth/OIDC, session, and RBAC/ABAC authentication patterns.

Community
Advanced
mamamoumamamou
16

react-security

Audit React/Next.js projects for OWASP 2025-aligned security risks and remediation plans.

Community
Advanced