skills.rest
marcogonzalo
marcogonzaloCOMMUNITY
Explore all skills by this author →
Website𝕏@MarcoGonzaloGitHub

veta-security-owasp

Enforce OWASP-aligned validation, authentication, authorization, and routing controls in Veta web app code.

1|Updated Nov 26, 2025
Search Tags:#input validation#owasp#server actions#security checklist#supabase rls#api authorization#broken access control
One-click install
npx skills add https://github.com/marcogonzalo/studio-manager --skill veta-security-owasp
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: veta-security-owasp
Source: https://github.com/marcogonzalo/studio-manager/tree/main/.agents/skills/veta-security-owasp
Command: npx skills add https://github.com/marcogonzalo/studio-manager --skill veta-security-owasp

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

This Skill helps you prevent common security failures in Veta by turning vague security concerns into an actionable, repeatable checklist for protecting forms, APIs, routing, and Supabase access.

Core Features & Use Cases

  • Application-layer hardening: Validate inputs server-side with Zod, reduce injection risk, and avoid unsafe rendering patterns like untrusted HTML injection.
  • Private API correctness: Ensure each src/app/api/* Route Handler performs explicit session checks, validates request data, and enforces authorization (preventing IDOR).
  • Defense-in-depth mapping to OWASP Top 10: Use a targeted OWASP-aligned checklist that focuses on Broken Access Control, Injection, Auth failures, Misconfiguration, SSRF, and related issues in the repo structure.
  • Operational verification: Perform quick manual checks for session-required pages and resource access across different user identities.

Quick Start

Ask for an OWASP-focused security audit of your change by reviewing the relevant files in Veta (forms, Server Actions, src/app/api/* route handlers, middleware public routes, and Supabase RLS) and returning a prioritized checklist of fixes.

Frequently Asked Questions about veta-security-owasp

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I secure Next.js Server Actions and Route Handlers against OWASP Top 10 vulnerabilities?▼

Securing Next.js Server Actions and Route Handlers against OWASP vulnerabilities requires server-side input validation with Zod, explicit per-handler session checks, and strict authorization to prevent broken access control and IDOR.

What is the best way to prevent IDOR in Supabase RLS and Next.js API routes?▼

Preventing IDOR in Supabase RLS and Next.js API routes requires enforcing strict authorization checks at the application layer and configuring Row Level Security policies as a defense-in-depth measure to restrict direct data access.

How do I validate inputs server-side in Next.js to reduce injection risk?▼

Validating inputs server-side in Next.js to reduce injection risk involves using Zod schemas to sanitize and validate request data before processing it in Server Actions or API Route Handlers, avoiding unsafe HTML injection.

Does this OWASP security checklist cover safe redirects and misconfiguration hygiene?▼

This OWASP security checklist covers safe redirects and misconfiguration hygiene by reviewing middleware public routes, enforcing safe redirect practices, and verifying session-required pages across different user identities.

Can I use Zod for authentication checks in Supabase and Next.js Route Handlers?▼

While Zod handles input validation in Next.js Route Handlers, you must perform explicit authentication checks by validating the user session directly in each Supabase or API handler to avoid auth failures.

Related Skills

Explore More Software Engineering Skills→
xoaixoai
25

stack-nextjs-supabase

Integrate Next.js App Router with Supabase using dual-client authentication and RLS policies.

Community
Advanced
Renzo-TognellaRenzo-Tognella

testing-for-broken-access-control

Test web applications for broken access control vulnerabilities using Burp Suite and ffuf.

Community
Advanced
dtabordadtaborda

template-bff

Enforce BFF standards for Next.js Server Actions and Route Handlers.

Community
Advanced
summarybotngsummarybotng
2

security-testing

Scan code, dependencies, and configurations for OWASP Top 10 vulnerabilities.

Official
Advanced