Security

amey-thakur Skill

Encrypt data at rest and in transit with vetted primitives and a managed key service that rotates on schedule. Use when handling sensitive data on disk or over the network, or when reviewing how a system stores and moves it.

amey-thakur Skill

Scope every credential to the minimum actions it uses, with per-workload identities and expiry so a leak has a small blast radius. Use when writing an IAM policy, provisioning a service account, or reviewing an access grant.

amey-thakur Skill

Produce signed software bills of materials from real artifacts and consume them to answer "are we affected" fast. Use when setting up build output, responding to a new advisory, or fielding a customer SBOM request.

amey-thakur Skill

Review code for the vulnerabilities that actually get exploited, ranked by real risk with concrete attack scenarios. Use when reviewing changes that touch input handling, auth, secrets, files, queries, or network calls.

amey-thakur Skill

Map assets, entry points, and STRIDE threats before writing code so defenses land in the design instead of a later patch. Use when starting a feature that handles auth, money, personal data, or external input.

amey-thakur Skill

Validate untrusted input at every trust boundary with allowlists, canonicalization, and hard limits so malformed data never reaches logic. Use when accepting data from requests, files, uploads, or third-party APIs.

amey-thakur Skill

Store passwords with a slow, salted, memory-hard hash and a plan to raise the cost over time. Use when building signup or login, migrating off a weak hash, or reviewing how a system persists user passwords.

amey-thakur Skill

Scan commit history and CI for leaked credentials and rotate on every hit, because a pushed secret is already compromised. Use when hardening a repo against committed keys or responding to a suspected leak.

amey-thakur Skill

Set the HTTP response headers that constrain what a browser will execute, embed, and leak on behalf of your origin. Use when hardening a web app against cross-site scripting, clickjacking, or referrer leakage, or when a security scan flags missing headers.

amey-thakur Skill

Configure transport layer security with modern protocol versions, automated certificate renewal, and strict transport enforcement. Use when standing up HTTPS on a server, terminating TLS at a proxy, or hardening an endpoint that already serves traffic.

amey-thakur Skill

Apply zero trust by authenticating and authorizing every request on its own merits and issuing only short-lived, narrowly scoped credentials. Use when designing service-to-service access, internal tooling, or any system that still trusts requests because of where they came from.

amey-thakur Skill

Rebalance a top-heavy test suite toward fast unit tests without dropping the coverage the slow tests provide. Use when end-to-end tests dominate the suite and CI is slow, flaky, or expensive to run.

amey-thakur Skill

Accept user file uploads without letting them become code execution, storage exhaustion, or a path into other users' data. Use when building an upload endpoint, an avatar or document feature, or any handler that writes client-supplied bytes to disk or object storage.

amey-thakur Skill

Keep credentials out of source by loading them from a controlled store, scanning for leaks, and rotating on a schedule. Use when adding a secret to an app, cleaning one out of a repository, or setting up how a service reads credentials at runtime.

amey-thakur Skill

Handle sessions so identifiers rotate on privilege change, expire on inactivity, can be revoked server-side, and ride only on hardened cookies. Use when issuing, storing, or validating session tokens after a user signs in.

amey-thakur Skill

Audit third-party packages by pinning resolved versions, scanning against advisory databases, and catching malicious lookalikes before install. Use when adding a dependency, wiring a vulnerability gate into CI, or reviewing what a project actually pulls in.

amey-thakur Skill

Protect a mobile app by storing secrets in the platform keystore, pinning certificates only where rotation is controlled, and treating obfuscation as delay rather than defense. Use when building or reviewing an iOS or Android app that holds tokens, keys, or user data on device.

amey-thakur Skill

Design authentication whose credentials cannot be relayed to a look-alike site, using origin-bound passkeys and hardware keys over phishable codes. Use when choosing MFA factors, building a passkey flow, or reviewing account recovery.

amey-thakur Skill

Stop UI redress attacks by declaring who may frame your pages, using frame-ancestors as the primary control and X-Frame-Options as the fallback. Use when hardening any page that performs sensitive actions on a click, especially authenticated dashboards and confirmation flows.

amey-thakur Skill

Read a diff for security by tracing attacker-controlled input to dangerous operations and checking every trust boundary it crosses. Use when reviewing code that handles input, queries, files, output rendering, or authorization.

amey-thakur Skill

Score incoming vulnerability reports the same way every time, tie each score to a fix deadline, and run disclosure on a predictable clock. Use when a vulnerability report arrives or when standing up a process to handle them.

amey-thakur Skill

Validate every redirect destination against a server-side allowlist so a user-controlled target cannot bounce victims onto an attacker's site. Use when an endpoint reads a next, return_to, or callback parameter and sends the browser there.

amey-thakur Skill

Prepare for a penetration test by fixing scope, rules, and access up front, then turn its findings into tracked, verified remediation. Use when commissioning an external pentest or acting on the report one delivered.

amey-thakur Skill

Detect committed credentials, respond correctly when one is found, and prevent the next one. Use when setting up a repository or after a credential appears in history.

amey-thakur Skill

Decide where a web app keeps tokens and state by reasoning about the XSS blast radius of each store, not by convenience. Use when choosing how to persist session tokens, auth state, or any value an attacker on your origin would want to read.

amey-thakur Skill

Treat any serialized bytes from outside the program as hostile, parsing them through schema-validated formats instead of native object reconstructors. Use when reading pickles, Java or PHP serialized objects, YAML, or any encoded structure that arrives from a user, a queue, or a cache.

amey-thakur Skill

Stop user-supplied path components from escaping the directory you meant to confine them to. Use when a filename, path segment, or archive entry from outside the program is joined into a filesystem path for reading, writing, or serving.

amey-thakur Skill

Prevent workflow automation from becoming an attack path, through pinned actions, scoped tokens, and careful handling of untrusted input. Use when workflows handle secrets or run on pull requests from forks.

komunite Skill

Analyze and produce a social audit with structured process, quality checks, and system integration

komunite Skill

Yapılandırılmış süreç, kalite kontrolleri ve sistem entegrasyonu ile bir teslim edilebilirlik denetimi analiz edin ve oluşturun

komunite Skill

Analyze and produce a ai bias audit with structured process, quality checks, and system integration

komunite Skill

Analyze and produce a security review with structured process, quality checks, and system integration

komunite Skill

Analyze and produce a dependency audit with structured process, quality checks, and system integration

komunite Skill

Yapılandırılmış süreç, kalite kontrolleri ve sistem entegrasyonu ile bir e-posta uyumluluk denetimi analiz edin ve oluşturun

komunite Skill

Analyze and produce a financial audit prep with structured process, quality checks, and system integration

komunite Skill

Analyze and produce a work life audit with structured process, quality checks, and system integration