skills.rest
wesselgrift
wesselgriftCOMMUNITY
Explore all skills by this author →
GitHub

security-review

Identify and mitigate security risks in SvelteKit SPAs with Supabase and Postgres RLS.

37|2|Updated Dec 24, 2025
Search Tags:#security#xss#rls#supabase#best-practices#sveltekit#csrf
One-click install
npx skills add https://github.com/wesselgrift/sveltekit-spa --skill security-review-wesselgrift
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: security-review
Source: https://github.com/wesselgrift/sveltekit-spa/tree/main/.cursor/skills/security-review
Command: npx skills add https://github.com/wesselgrift/sveltekit-spa --skill security-review-wesselgrift

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

Security gaps in client-side SvelteKit apps using Supabase and Postgres RLS are common; this guide helps identify, prioritize, and mitigate those risks across auth flows, data access, and UI rendering.

Core Features & Use Cases

  • Comprehensive security checklist for RLS, auth flows, input validation, env vars, and UI gating.
  • Defensive patterns: recommends defense-in-depth practices, secure RPC usage, and safe env handling for modern SPAs.
  • Use Case: When a new feature touches authentication or data access, apply this guide to audit security and reduce risk.

Quick Start

Review and apply the security hardening patterns to your SvelteKit SPA.

Frequently Asked Questions about security-review

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I secure Supabase Row Level Security policies in a SvelteKit app?▼

You can secure Supabase RLS in SvelteKit by applying defense-in-depth patterns, auditing data access flows, validating auth states, and using security definer RPCs safely to prevent data leaks.

What is the best way to prevent XSS in SvelteKit client-side rendering?▼

The best way to prevent XSS in SvelteKit client-side rendering is to follow strict input validation and UI gating guidelines, ensuring safe environment variable handling and checking rendering scenarios for data exposure.

How do I audit SvelteKit authentication flows for security gaps?▼

You audit SvelteKit authentication flows by reviewing auth states against Supabase RLS rules, checking environment variable exposure, and applying a comprehensive security checklist to identify and mitigate risks.

Can I use this security checklist for SvelteKit SPAs using Postgres without Supabase?▼

This security checklist specifically targets SvelteKit SPAs using Supabase and Postgres RLS, focusing on Supabase auth flows and definer RPC safety, making it less applicable to standard Postgres setups without Supabase.

Why does my SvelteKit SPA leak data despite having RLS enabled in Supabase?▼

Data leaks in SvelteKit SPAs despite RLS often occur due to overlooked client-side rendering scenarios, insecure environment variable handling, or gaps in input validation and auth flow UI gating.

Related Skills

Explore More Software Engineering Skills→
Joel-barriosnuevoJoel-barriosnuevo

supabase-postgres-best-practices

Optimize Postgres performance and best practices for Supabase projects.

Community
Advanced
protofireprotofire
3

protofire-qa-agent

Audit smart contracts with Slither, Echidna, and Foundry fuzz testing.

Official
Advanced
SaschaLehSaschaLeh

supabase-edge-functions

Automate creation and secure operation of Supabase Edge Functions with Deno.

Community
Advanced
dajneem23dajneem23

security-best-practices

Review code for web vulnerabilities and framework-specific security best practices.

Community
Advanced