Paths in this file are relative to this skill's folder.

Secure by default

Apply these rules, unasked, to every line you write or edit that touches auth, data, secrets, payments, uploads, outbound requests or a model call. It is cheap now and expensive to retrofit.

Six laws

1. The browser is public. A secret, a price or an auth decision that reaches the client is already broken.
2. Deny by default. Every table, row, route and Server Action checks "is this this user's", not just "is someone logged in".
3. Never trust the request body for price, role, quantity, owner ids or verification flags. Take the user id from the verified session.
4. Verify every payment webhook signature and fail closed when the secret is unset.
5. Treat user input and model output as untrusted at every sink: HTML, SQL, shell, URL, file path.
6. Secrets live only on a server you control, never behind a public env prefix.

When a law blocks the quick fix, fix the cause:

• An env var undefined in the browser means the call belongs on the server. Do not add NEXT_PUBLIC_ or VITE_.
• A CORS error means add the one origin that needs access, not every origin.
• An empty Supabase result means write the right policy, not using (true) or the service key.
• An SDK that refuses to run in the browser is right. Do not set dangerouslyAllowBrowser for a key you ship.

Auth and data access

• Supabase: in the same change that creates a table, add alter table <t> enable row level security; and one policy per operation to authenticated, with using ((select auth.uid()) = user_id) and with check ((select auth.uid()) = user_id) on insert and update. Use using (true) only on truly public, read-only tables with no private columns.
• Never read user_metadata in a policy; users can edit it. Keep roles in app_metadata, a roles table the user cannot write, or Firebase custom claims (request.auth.token.admin == true).
• A Supabase security definer function lives in a schema the API does not expose and sets search_path = ''. A function only the server calls gets revoke execute ... from public, anon, authenticated; a grant to service_role alone locks nothing. Views over protected tables use with (security_invoker = true).
• Firebase rules: allow read, write: if request.auth != null && request.auth.uid == userId; (or compare resource.data.ownerUid). Never ship if true, a bare request.auth != null on per-user data, or the test-mode date rule.
• Every query by an id from the request also filters by owner (where: { id, userId: session.userId }) or checks the row's owner before returning or changing it. Return 404 otherwise.
• Route handlers and Server Actions are public endpoints. Validate arguments and check auth and ownership inside each one; a page, layout or middleware check does not cover them (middleware or proxy.ts only redirects, CVE-2025-29927). In server code use getClaims() or getUser(), never getSession().
• Admin checks run on the server against a server-side role. Client flags (isAdmin, localStorage) only hide buttons.
• Write allow-listed fields only: const { title, body } = input, then set user_id from the session. Never insert(req.body), Model(**data), create($request->all()) or DRF fields = '__all__'.

More: references/data-and-auth.md.

Secrets

• NEXT_PUBLIC_, VITE_, EXPO_PUBLIC_, REACT_APP_, PUBLIC_, next.config env:, Vite define and app.json extra all put the value in the shipped bundle. A secret never goes there; move the call to a server route, Edge Function or Cloud Function.
• Never create a Supabase client with service_role or sb_secret_ in browser or app code, and never call supabase.auth.admin from the client.
• Public by design, leave them in the client: Stripe pk_, Supabase anon or sb_publishable_, Firebase web apiKey, Sentry DSN, PostHog phc_, reCAPTCHA and Turnstile site keys. RLS, rules and key restrictions protect them, not secrecy.
• Read secrets through a loader that throws when the variable is missing: no || 'secret' or ?? 'dev-key' fallbacks, no tutorial values. Generate signing secrets per environment (openssl rand -base64 48).
• A key the user pastes goes into the git-ignored .env, never into source; put a placeholder in .env.example. Never return or log process.env or os.environ.

More: references/secrets.md.

Payments and metered endpoints

• The client sends a product or plan id. The server takes the price from its own catalog (PRICES[plan]) or a Stripe Price id. Never amount, price or unit_amount from the request.
• Webhooks: read the raw body (await req.text(), or express.raw() mounted before express.json()), call stripe.webhooks.constructEvent(raw, sig, secret), return 500 when the secret is unset and 400 on a bad signature. Never wrap verification in if (secret).
• Grant access from the webhook on checkout.session.completed and checkout.session.async_payment_succeeded, only when payment_status is not unpaid (ACH and SEPA complete unpaid), idempotently (unique session or event id, on conflict do nothing). A success page may call the same fulfill function after retrieving the session from Stripe, granting to its client_reference_id, never from client data.
• Every route that costs money (model calls, email, SMS, images) requires auth, a per-user rate limit and input size caps. OTP, signup and password-reset sends also get a per-destination throttle, a resend cooldown and a CAPTCHA.

More: references/payments-and-abuse.md.

Uploads and server-side fetch

• Check file type from the content (magic bytes), allow-list extensions, re-encode images and cap the size (multer limits.fileSize). Never trust the extension or Content-Type.
• Store files under a random server-side name. Never put originalname in a path; if you must build one, path.basename it and verify the resolved path stays inside the upload root.
• Keep user files private (private bucket, per-user Storage rules) and serve them through signed URLs with Content-Disposition: attachment and X-Content-Type-Options: nosniff. Never serve user SVG or HTML inline.
• Fetching a user-supplied URL: https only and a host allow-list. If any host must work, resolve DNS and reject private, loopback and link-local addresses at connect time and again after every redirect. next/image remotePatterns lists exact hosts, never **.

More: references/uploads-and-fetch.md.

LLM endpoints

• Call the model from the server with a server-only key. Require auth, a per-user rate limit, a prompt length cap and an output token cap. The server picks the model, system prompt and tools; never take them from the request.
• Render model output as text or through a sanitizer (react-markdown without rehype-raw, or DOMPurify). Never pass it raw to dangerouslySetInnerHTML, v-html, innerHTML, eval, SQL or a shell.
• No keys, connection strings or access rules in the system prompt. Assume it leaks and enforce access in code.
• Tools run with the end user's permissions (an RLS-scoped client, read-only where possible), never service_role. Validate model-chosen arguments like user input.
• If one agent holds private data, reads untrusted content (web pages, emails, uploads, other users' text) and can act outward (send, post, write, fetch a URL), break one leg: drop the tool, or require human approval before the outward action.

More: references/llm-endpoints.md.

Queries, rendering, redirects and config

• SQL: placeholders only ($1, ?, Prisma tagged $queryRaw). Never interpolate input into $queryRawUnsafe, whereRaw, .extra(), f-strings or string concatenation. Sort columns and directions come from an allow-list.
• Mongo: cast input to scalars (String(x)) or schema-validate it, so an object cannot become a query operator.
• Shell: execFile, spawn([...]) or subprocess.run([...]) with an argument list. Never exec, os.system or shell=True with input.
• HTML: let the framework escape. Raw sinks (dangerouslySetInnerHTML, v-html, {@html}, Blade {!! !!}, Jinja |safe, mark_safe) only take sanitized strings.
• Redirects from next, returnTo or redirect: accept a path only if it starts with exactly one / and has no backslash, tab, CR or LF (browsers drop those and read \ as /, so /<tab>/evil.com reaches //evil.com), else use a default. Or require new URL(value, base).origin to equal the base origin.
• CORS: an exact origin list from env. Never origin: true, a reflected Origin header or allow_origins=["*"] together with credentials.
• Cookies: httpOnly, secure in production, sameSite: 'lax'. Keep the framework's CSRF protection on and exempt only signature-verified webhooks; cookie-auth route handlers check Origin or a CSRF token.
• Production: debug off (DEBUG, APP_DEBUG, Flask debug), NODE_ENV=production, generic error bodies, and no request bodies, auth headers, tokens or passwords in logs.

More: references/uploads-and-fetch.md (SQL, Mongo, shell, HTML) and references/payments-and-abuse.md (CSRF, redirects).

Handoff

Asked whether a built app is safe, or about to deploy: hand off to preflight-audit. Given the user's own running URL: hand off to live-exposure-check.