veta-security-owasp

What problem does it solve?

This Skill helps you prevent common security failures in Veta by turning vague security concerns into an actionable, repeatable checklist for protecting forms, APIs, routing, and Supabase access.

Core Features & Use Cases

• Application-layer hardening: Validate inputs server-side with Zod, reduce injection risk, and avoid unsafe rendering patterns like untrusted HTML injection.
• Private API correctness: Ensure each src/app/api/* Route Handler performs explicit session checks, validates request data, and enforces authorization (preventing IDOR).
• Defense-in-depth mapping to OWASP Top 10: Use a targeted OWASP-aligned checklist that focuses on Broken Access Control, Injection, Auth failures, Misconfiguration, SSRF, and related issues in the repo structure.
• Operational verification: Perform quick manual checks for session-required pages and resource access across different user identities.

Quick Start

Ask for an OWASP-focused security audit of your change by reviewing the relevant files in Veta (forms, Server Actions, src/app/api/* route handlers, middleware public routes, and Supabase RLS) and returning a prioritized checklist of fixes.