What problem does it solve? Applications handling payments and user PII are high-risk targets, and insecure patterns like hardcoded tokens, sensitive data in URLs, or unvalidated deep links can slip into code during fast development. This Skill enforces security rules specific to the order-ui codebase whenever auth flows, payment screens, or credential-handling code is written. ## Core Features & Use Cases - Token & Credential Safety: Ensures tokens live only in the Zustand auth store, are never logged or hardcoded, and are cleared via setLogout(). - API & Input Security: Verifies the http.unified.ts interceptor handles auth headers, sensitive data goes in request bodies not URLs, and Zod validates all form input. - Platform-Specific Checks: Covers Capacitor deep link whitelisting, Firebase push notification code filtering, printer API key handling, and the isAuthInitialized auth gate. - Use Case: When writing a new payment form, the Skill checks that card data is sent via POST body, validated with Zod, and that no raw API errors are shown to users. ## Quick Start Review this new payment form component for security issues before I commit it.
