skills.rest
marquesfelip
marquesfelipCOMMUNITY
Explore all skills by this author →
GitHub

tenant-data-leak-prevention

Enforce tenant_id scoping across queries, APIs, caches, and background jobs.

Updated Mar 29, 2026
Search Tags:#audit#multitenancy#data-serialization#idor#tenant-isolation#secure-api-design#data-leak-prevention
One-click install
npx skills add https://github.com/marquesfelip/agents-and-skills --skill tenant-data-leak-prevention
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: tenant-data-leak-prevention
Source: https://github.com/marquesfelip/agents-and-skills/tree/main/skills/tenant-data-leak-prevention
Command: npx skills add https://github.com/marquesfelip/agents-and-skills --skill tenant-data-leak-prevention

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

Protections against cross-tenant data exposure in multi-tenant SaaS systems. This skill provides a structured approach to enforce tenant boundaries across repositories, APIs, caches, and background jobs, reducing the risk of accidental data leakage.

Core Features & Use Cases

  • Enforce tenant isolation at the repository layer by requiring tenant_id in all queries.
  • Implement explicit response serialization to avoid leaking internal fields and tenant metadata.
  • Enforce tenant-scoped search, per-tenant caches, and tenant-aware background jobs.
  • Provide an audit framework to identify and remediate cross-tenant exposure during pre-release checks.

Quick Start

Audit all API endpoints and data queries to ensure tenant_id scoping and explicit DTO-based responses.

Frequently Asked Questions about tenant-data-leak-prevention

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I prevent cross-tenant data leakage in a multi-tenant SaaS architecture?▼

Prevent cross-tenant data leakage by enforcing tenant isolation across repository queries, API responses, caches, and background jobs. This structured approach requires tenant_id in all queries to reduce accidental data exposure between tenants.

How do I enforce tenant isolation at the repository and API layers?▼

Enforce tenant isolation by requiring tenant_id scoping in all repository queries and implementing explicit DTO-based responses. This prevents over-exposed fields and ensures internal tenant metadata is not leaked through API endpoints.

Why does my multi-tenant API return data from other tenants?▼

Your multi-tenant API returns cross-tenant data because queries lack mandatory tenant_id filters and response serialization is not explicit. Implementing tenant scoping and DTO-based responses prevents this accidental data exposure.

How do I audit multi-tenant systems for cross-tenant exposure before release?▼

Audit multi-tenant systems for cross-tenant exposure by checking all API endpoints and data queries to ensure tenant_id scoping and explicit DTO-based responses. This audit framework identifies missing tenant filters during pre-release checks.

How do I handle tenant isolation for shared resources like caches and background jobs?▼

Handle tenant isolation for shared resources by implementing per-tenant caches and tenant-aware background processing. This ensures background jobs and caching mechanisms maintain strict tenant boundaries and prevent data leakage.

Can I use this tenant data leak prevention approach for any multi-tenant SaaS application?▼

Yes, this tenant data leak prevention approach applies to multi-tenant SaaS architectures universally. It provides guardrails for tenant scoping, serialization, and isolated search to secure shared resources across diverse implementations.

Related Skills

Explore More Software Engineering Skills→
baleen37baleen37
10

condition-based-waiting

Replace arbitrary setTimeout calls with condition polling in tests.

Community
Intermediate
sseshachalasseshachala

hunt-idor

Identify and exploit IDOR vulnerabilities in multi-tenant REST and GraphQL endpoints.

Community
Advanced
marquesfelipmarquesfelip

tenant-isolation

Enforce tenant isolation across data queries, storage, and background processing.

Community
Advanced
robotijnrobotijn
3

multi-tenancy-row-level

Implement Postgres Row-Level Security policies to enforce tenant scoping in multi-tenant SaaS databases.

Community
Advanced