Skills for security auditing, vulnerability scanning, and compliance checks.
Website security and performance audit. Checks for vulnerabilities, accessibility issues, SEO problems, and performance bottlenecks.
Authentication best practices using Better Auth library. Session management, OAuth providers, RBAC, and security hardening.
Implements OAuth 2.0 and OIDC flows (authorization code, PKCE, client credentials) with provider-specific configurations for Google, GitHub, and more.
Implements secure JWT creation, validation, and rotation with proper algorithm selection, claim validation, and key management.
Implements comprehensive server-side input validation and sanitization for APIs and web forms to prevent injection attacks and data corruption.
Apply security best practices to code and infrastructure
Scan codebases for OWASP Top 10 vulnerabilities, insecure dependencies, and hardcoded secrets. Produces a prioritized vulnerability report with CVE references and remediation code examples.
Deep architectural context via ultra-granular code analysis before auditing
Parse BurpSuite project files for security analysis
Analyze code for timing side-channel vulnerabilities
Security-focused differential code review between versions
Analyze DWARF debug information in compiled binaries
Map application entry points for attack surface analysis
Check for false positives in security scanning results
Scans codebases, configuration files, and git history for exposed credentials, API keys, tokens, and other sensitive secrets that should not be committed.
Analyzes project dependencies for known vulnerabilities (CVEs), license compliance issues, outdated packages, and supply chain security risks.
Audit codebases and infrastructure configurations against GDPR, SOC 2, PCI-DSS, and HIPAA requirements. Produces gap analysis reports with remediation steps prioritized by risk.
Conducts automated security assessments including reconnaissance, vulnerability scanning, exploitation verification, and penetration testing report generation.
Designs and validates RBAC (Role-Based) and ABAC (Attribute-Based) access control policies, generates policy code, and audits existing authorization logic.
Validates Cross-Origin Resource Sharing (CORS) and Content Security Policy (CSP) configurations to prevent data leakage and cross-origin attacks.