skills.rest
Leandelosantos
LeandelosantosCOMMUNITY
Explore all skills by this author →
WebsiteGitHub

senior-security

Validate JWT secrets, superadmin gates, and tenant isolation policies in Maestro Dashboard middleware.

Updated Apr 4, 2026
Search Tags:#automation#security#jwt#audit#rate-limiting#cross-tenant
One-click install
npx skills add https://github.com/Leandelosantos/huevos-point-maestro --skill senior-security-leandelosantos
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: senior-security
Source: https://github.com/Leandelosantos/huevos-point-maestro/tree/main/.claude/skills/senior-security
Command: npx skills add https://github.com/Leandelosantos/huevos-point-maestro --skill senior-security-leandelosantos

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill includes scripts (resource) and references (resource) components.

What problem does it solve?

The Maestro Dashboard needs airtight authentication, JWT handling, cross-tenant isolation, rate limiting, and auditing so superadmins can monitor all tenants without leaking secrets or exposing sensitive data.

Core Features & Use Cases

  • JWT and superadmin defense: Validate shared secrets, enforce strict claim checks, and expire auto-login tokens within one hour before they reach middleware.
  • Cross-tenant guardrails: Embed explicit tenant_id filters, return 404 for missing tenants, and log every cross-tenant access in an append-only audit table.
  • Operational hardening: Harden CORS, rate limiting, headers, and input sanitization while preventing logging of secrets or trusting frontend-supplied tenant IDs.
  • Use Case: Before rolling out a release, run the auditor and pentest tools to verify dashboard middleware, rate limits, and logging policies so the superadmin channel cannot leak data.

Quick Start

Ask the senior-security skill to audit the Maestro Dashboard's JWT handling, rate limiting, and cross-tenant access policies.

Frequently Asked Questions about senior-security

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I audit JWT handling and superadmin access controls for a multi-tenant dashboard?▼

You audit JWT handling by validating shared secrets, enforcing strict claim checks, and expiring auto-login tokens within one hour before they reach middleware, preventing superadmin channel data leaks.

What is the best way to enforce cross-tenant isolation and prevent data leakage in admin panels?▼

The best way to enforce cross-tenant isolation is by embedding explicit tenant_id filters, returning 404 for missing tenants, and logging every cross-tenant access in an append-only audit table.

How do I harden CORS, rate limiting, and input sanitization before a dashboard deployment?▼

You harden CORS, rate limiting, and input sanitization by configuring strict headers, preventing secret logging, and rejecting frontend-supplied tenant IDs before rolling out a release.

Does this security auditing approach work for incident response and penetration testing?▼

Yes, this approach works for incident response and penetration testing by running automated pentest scripts that verify middleware, rate limits, and logging policies to produce structured reports.

Why should I not trust frontend-supplied tenant IDs in a multi-tenant application?▼

You should not trust frontend-supplied tenant IDs because doing so bypasses cross-tenant guardrails, risks data leakage across tenants, and compromises the security of the superadmin monitoring channel.

Related Skills

Explore More Software Engineering Skills→
KILWA73KILWA73

auth-flow-validator

Audit JWT handling, Argon2 hashing, and session management in authentication flows.

Community
Advanced
ArtisanClarinetsArtisanClarinets

prisma-data-model

Enforce tenant isolation and audit-ready mutations in Prisma data models.

Community
Intermediate
jefeishjefeish

agent-governance

Enforce composable policies, pre-flight intent checks, and append-only audit logs for AI agents.

Community
Advanced
AcczdyAcczdy
2

implementing-api-gateway-security-controls

Automate API gateway security controls across Kong, AWS, Azure, and Apigee.

Community
Advanced