Loading...
Loading...
Found 6 Skills
Audit and harden Convex authorization: identity-from-arg impersonation, missing per-document ownership checks, PII-leaking public queries, and writes into containers the caller doesn't own. Deterministic scan + canonical requireIdentity/requireOwner fix + tsc verify. Use for 'secure my app' / 'audit auth' / 'who can access this data', not generic code review.
Audit and harden a Convex app's authorization: identity-from-arg impersonation, missing per-document ownership checks, public queries leaking data by a client-supplied id, and writes into a parent/container the caller doesn't own. Scans for the 4 shapes, applies requireIdentity/requireOwner, verifies with tsc. TRIGGER on 'secure my app', 'audit auth/authz', 'who can access this data'. SKIP when there is no convex/ directory.
Backend security review and hardening for authentication, authorization, tokens, sessions, secrets, validation, injection, payments, uploads, webhooks, data exposure, rate limits, and deployment configuration. Use when asked to audit, security-review, harden, threat-check, or inspect backend code for vulnerabilities across Express, NestJS, Django, Rails, Go, and other stacks.
Conduct threat modeling, vulnerability assessments, secret sanitization, and security reviews across trust boundaries, auth flows, and untrusted inputs. Use when auditing authentication/authorization logic, inspecting APIs for injection/CORS/CSRF risks, checking for hardcoded credentials, or reviewing security-sensitive diffs — even if the user does not explicitly say "fable-security" (e.g. "security audit this code", "check for vulnerabilities", "verify auth logic", "scan for leaked secrets"). Do NOT use for general style reviews (use fable-review) or non-security bug fixes (use fable-tdd).
Assess IBM i security posture including user privileges, object authorities, vulnerability detection, and function usage via SQL services. Use when user asks about: (1) user profiles with special authorities or limited capabilities, (2) object privileges and *PUBLIC authority exposure, (3) files vulnerable to trigger, rename, or library list attacks, (4) user impersonation vulnerabilities, (5) group profile membership, (6) function usage and access control, (7) security audit and compliance, or (8) replacing WRKOBJAUT, DSPUSRPRF, DSPAUTL commands.
Comprehensive OWASP API Security Top 10 auditing across REST, GraphQL, gRPC, and WebSocket APIs covering object/function-level authorization, mass assignment, OpenAPI schema validation, and token-bucket rate limiting.