What problem does it solve?
This Skill helps you prevent security vulnerabilities caused by unsafe trust boundaries in VTEX IO apps by ensuring that public exposure, input validation, and data handling are reviewed and tightened.
Core Features & Use Cases
- Trust-boundary exposure review: Identify what is internet- or partner-exposed when
public: true and treat every public route as untrusted.
- Boundary input validation: Validate incoming body/params/headers before domain logic or downstream client calls, including webhook authenticity checks.
- Leakage prevention across context: Prevent tokens, sensitive headers, raw downstream payloads, and cross-account/workspace/user data from crossing boundaries unintentionally.
- Service-to-service boundary discipline: Apply explicit validation and scoped assumptions even for internal service calls.
- Response shaping and logging safety: Ensure minimal, intentionally shaped outputs and avoid leaking secrets through logs or
console.log.
Quick Start
Review the VTEX IO route or integration to confirm that public exposure is explicit, validate all untrusted inputs at the boundary, and ensure responses and logs do not leak secrets or cross context.
