What problem does it solve? Codebases drift into insecure patterns: unvalidated request bodies, hardcoded secrets, string-concatenated SQL, hand-rolled auth, and LLM output trusted blindly. This Skill codifies the daily security floor so every trust boundary gets validated by default, without waiting for a periodic audit. ## Core Features & Use Cases - Trust-boundary validation: Requires Zod schema validation at every point where untrusted data enters the system (HTTP bodies, webhooks, form input, third-party SDK responses, LLM output), banning JSON.parse without schemas and as type assertions. - Secrets and logging discipline: Mandates validated env-based secrets (with an encrypted-at-rest exception for customer BYO credentials), and bans PII or secrets in logs, error messages, and Sentry breadcrumbs. - Auth, SQL, and LLM safety: Requires Better-Auth (or Clerk) instead of hand-rolled auth, parameterized Drizzle queries instead of string concatenation, and treats LLM input/output as untrusted against prompt injection and hallucination. - Use Case: While writing a Server Action that processes a checkout form, the Skill ensures you parse the FormData with a Zod schema, read the Stripe key from the validated env module, and query the database through Drizzle rather than raw string interpolation. ## Quick Start Ask the agent to review or write code that crosses a trust boundary, such as "add a webhook handler for Stripe events", and the security defaults apply automatically.
