Workspace Forge

Security hardening for React Server Components (RSC), React Flight protocol, and Next.js App Router against CVE-2025-55182 (React2Shell) and related deserialization attacks. Use when building, reviewing, or auditing any application using React Server Components, Next.js App Router, server actions, or the Flight protocol. Covers version verification, patch validation, server component boundary security, serialization attack surfaces, and HTTP request smuggling (CVE-2026-29057). Essential for any Next.js 13+ / React 19 application.

React and Next.js specific security patterns, XSS prevention, server/client boundary safety, and auth flow best practices for our stack.

Architecture patterns for Supabase Realtime in competitive/live applications. Covers channel design, broadcast vs postgres_changes, presence, scaling, anti-cheat delays, reconnection, cleanup, security (RLS on realtime, channel auth, anti-spoofing), performance (batching, throttling, filters). Includes decision framework for Realtime vs polling vs SSE.

Search implementation — Postgres FTS, fuzzy search with pg_trgm, vector search with pgvector, search UX patterns, and when to use external search.

TypeScript type safety review — catching any, unsafe assertions, weak validation, and common TS mistakes in Next.js + Supabase applications.

Product analytics — self-hosted privacy-friendly tracking, event architecture, funnel/cohort analysis, and key metrics per product.

Complete production starter architecture for Next.js + Supabase + Vercel. Given a product spec, produce the full file tree, schema, middleware, error handling, logging, auth pattern, and env template in one shot.

Security review and hardening for GitHub Actions CI/CD pipelines. Use when reviewing workflow files (.github/workflows/), auditing third-party actions, checking secret exposure in CI, reviewing deployment pipelines, or investigating CI/CD supply chain attacks. Covers the tj-actions/changed-files compromise (23K repos, March 2025), Trivy GitHub Actions compromise (March 2026), Clinejection (prompt injection → cache poisoning → npm publish, Feb 2026), Shai Hulud attacks, workflow injection via issue/PR titles, cache poisoning, secret exfiltration, and the full taxonomy of GitHub Actions attack vectors.

CORS (Cross-Origin Resource Sharing) and CSP (Content Security Policy) configuration review and hardening for Next.js applications. Use when reviewing security headers, API route CORS configuration, middleware header injection, next.config.js headers, or any frontend security policy. Covers CORS misconfigurations that enable cross-origin data theft, CSP bypasses that enable XSS, header injection, clickjacking prevention, and the complete security headers checklist for production Next.js + Vercel deployments.

Schema design from product specs — entity extraction, normalization, naming conventions, index strategy, RLS patterns, migration generation, and seed data.

Security patterns for multi-tenant SaaS applications built on Supabase + Next.js. Use when reviewing applications where multiple organizations/teams share the same database, reviewing RLS policies with org/team scoping, checking for cross-tenant data leakage, auditing shared resource isolation, or building any B2B SaaS product (UberKiwi, white-label platforms). Covers tenant isolation via RLS, tenant context propagation, cross-tenant IDOR, shared resource abuse, tenant-scoped API keys, data export isolation, and the specific patterns where Supabase's architecture creates multi-tenant risks.

Detection and prevention of Denial of Service vulnerabilities in Node.js applications — ReDoS (Regular Expression Denial of Service), event loop blocking, resource exhaustion, algorithmic complexity attacks, and application-layer DoS patterns. Use when reviewing code containing regular expressions, input parsing, file processing, database queries without limits, recursive operations, or any code that processes user-controlled input where processing time is proportional to input complexity. Covers CVE-2026-30925 (Parse Server ReDoS — CRITICAL), catastrophic backtracking, polynomial/exponential regex patterns, and Node.js-specific event loop starvation.

State machines for Arena challenges, OUTBOUND leads, and payment flows — TypeScript discriminated unions, transition validation, XState for complex flows.

Distributed system patterns applied to Next.js + Supabase + Vercel — idempotency, circuit breakers, caching, event-driven architecture, sagas, and rate limiting.

Webhook patterns at scale — inbound handling (Stripe, Supabase), outbound sending with retry, monitoring, and dead letter queues.

Advanced React composition patterns, hooks architecture, Server Component patterns, and Next.js App Router patterns for building elegant, maintainable UIs.

Rate limiting design, implementation review, and bypass detection for Next.js API routes and Supabase Edge Functions. Use when reviewing API endpoints for abuse resistance, checking authentication endpoints for brute force protection, reviewing data endpoints for scraping prevention, or auditing public endpoints for DoS resistance. Covers per-user, per-IP, per-endpoint strategies, sliding window vs fixed window vs token bucket algorithms, common bypass techniques (header spoofing, distributed attacks, account rotation), Vercel-specific rate limiting, and Supabase's built-in limits.

How blockchain actually works — consensus, EVM, gas, transactions, smart contracts, token standards, L1 vs L2. The engineering, not the hype.

Expose when a judgment is high-confidence vs thin-evidence without undermining the platform's authority — covering the confidence trilemma, per-tier UI patterns, data model, copy patterns, and hard rules on when NOT to show confidence indicators.

Detection and defense against unsafe deserialization vulnerabilities across all boundaries where data becomes code. Use when reviewing code that deserializes user input, parses structured data formats (JSON, YAML, XML, MessagePack, Protocol Buffers), uses React Flight/RSC protocol, handles webhooks, processes file uploads, reads cached data, or uses any library that reconstructs objects from wire format. Covers React Flight (CVE-2025-55182), Svelte devalue (CVE-2026-30226), flatted (CVE-2026-33228), Python pickle, YAML load, Node.js node-serialize, and every deserialization boundary in our Next.js + Supabase stack.

Docker best practices — multi-stage builds, security, Docker Compose for dev, and OpenClaw container specifics.

Purpose-built LLM classifier design for failure mode taxonomy — 15-code classification with confidence scoring, anti-convergence patterns, evidence anchoring, and anti-generic prompt enforcement.

File upload security, Supabase Storage patterns, presigned URLs, file validation, CDN caching, and storage architecture for Arena/MathMind/OUTBOUND.

Systematic detection of obfuscated code execution, hidden backdoors, and malicious patterns in Python and JavaScript/TypeScript. Use when reviewing code for backdoors, auditing new dependencies, scanning PRs for obfuscated exec/eval/compile patterns, detecting dynamic code generation disguises (builtins aliasing, importlib abuse, getattr chains, compile+FunctionType, base64+eval), homoglyph identifiers, environment-gated payloads, dead-code-that-isn't-dead, and intentional syntax errors used as evasion. Covers all known exec/eval obfuscation families and their detection methods including AST-level analysis.

Handle GitHub OAuth flows in Playwright for Agent Arena. Correct technique using page.goto() for the auth initiation URL — not button clicks or fetch interception. Handles login, authorization grant, callback, and session verification.

The definitive secure coding reference for our Next.js + Supabase + TypeScript stack — the ONE document that, if followed, produces secure code on first write. Use when Maks needs a reference for how to write secure code, when onboarding new developers, when creating coding guidelines, or when establishing the "one right way" for common security-sensitive patterns. Not "here's what's wrong" but "here's exactly how to write it correctly." Every pattern is copy-pasteable and production-ready.

Bash scripting best practices, Node.js CLI tools, and shell script review checklist for OpenClaw deployment, Arena installer, and migration scripts.

Stripe Checkout, subscriptions, webhook handling, one-time payments, and Supabase integration patterns. Covers the complete payment lifecycle for Arena and OUTBOUND.

Supabase-specific security vulnerabilities, RLS bypass techniques, auth pitfalls, and attack vectors that are unique to the Supabase + Next.js stack.

Internal admin tools for inspecting, monitoring, and improving judge outputs — including raw output inspection, calibration drift detection, missing evidence detection, low-signal output flagging, and a feedback quality dashboard.

Auth security deep dive — OAuth PKCE, Supabase Auth internals (getSession vs getUser vs getClaims), social login edge cases, session management, MFA.

Design lane structure, scoring dimensions, weighting logic, calibration rules, and anchor-based criteria so Bouts produces defensible, consistent AI judgments instead of vibes.

Fraud detection for Arena anti-cheat and OUTBOUND abuse prevention — behavioral analytics, statistical anomaly detection, velocity checks, fingerprinting, abuse pattern catalog.

Multi-stage async LLM pipeline design — stage isolation, structured handoffs, idempotency, concurrency-safe profile updates, and failure handling across chained LLM calls.

Security patterns for Stripe payment integration, webhook verification, and financial transaction safety in Next.js + Supabase applications. Use when reviewing Stripe checkout flows, webhook handlers, subscription management, payment intent processing, refund logic, pricing endpoints, or any code that handles money. Covers CVE-2026-21894 (n8n missing Stripe-Signature verification — forged webhooks), CVE-2026-2890 (payment reuse for higher-cost items), legacy Stripe API skimming, webhook replay attacks, price manipulation, subscription state bypasses, and idempotency requirements.

Self-review, confidence rating, red team/blue team thinking, and learning from mistakes. Applied to all Forge output before submission.

COPPA (MathMind), CAN-SPAM (OUTBOUND), GDPR (Arena), and implementation patterns for account deletion, data export, consent tracking.

Email infrastructure — transactional vs marketing vs cold, React Email templates, Resend integration, deliverability fundamentals, and review checklist.

Schema design for Bouts feedback data — model for future questions not just current queries, normalize evidence refs, build audit trails, know when to use JSONB vs columns, and evolve schemas safely without breaking existing records.

k6 load testing, capacity planning, bottleneck identification, and performance budgets for production systems.

Background job processing with Supabase — jobs table, FOR UPDATE SKIP LOCKED, pg_cron polling, webhook triggers, retry patterns, and when to use external queues.

Recognize and evaluate design patterns in code — repository, strategy, observer, factory, adapter, state machine, middleware. Plus anti-patterns to catch.

DNS-level attacks affecting web applications — subdomain takeover, dangling DNS records, DNS rebinding for SSRF bypass, and domain security configuration. Use when auditing DNS configuration, reviewing domain setup for new products/services, decommissioning services (the most dangerous time for dangling DNS), or reviewing infrastructure that uses multiple subdomains, CDNs, or cloud services. Covers subdomain takeover via Vercel/Heroku/GitHub Pages/S3 dangling CNAMEs, DNS rebinding to bypass SSRF protections, DNSSEC, CAA records, SPF/DKIM/DMARC for email spoofing prevention, and domain hygiene.

Methodology for constructing exploit chains from individual findings — combining low/medium vulnerabilities into critical attack paths. Use when performing threat modeling, reviewing the aggregate risk of multiple findings in a single codebase, escalating severity through vulnerability chaining, or training the attacker mindset needed for elite security review. Covers real-world chain examples (SSRF→metadata→creds, prototype pollution→gadget→RCE, IDOR→CSRF→account takeover, open redirect→OAuth→token theft), chain construction methodology, and severity escalation rules.

Expo/React Native patterns for MathMind and Arena mobile — navigation, NativeWind, performance, offline-first, push notifications, App Store deployment, security.

Structured incident response procedures for security breaches, data exposure, account compromise, and service abuse. Use when a security incident is detected or suspected — credential leak, data breach, unauthorized access, compromised dependency, defacement, or any event requiring immediate security response. Provides the step-by-step runbook for the first 30 minutes (golden hour), evidence preservation, containment strategies, communication templates, and post-incident analysis. Designed for a small team (Perlantir) where the same people build and respond.

Define the raw output contract for Bouts AI judges — lane scores, dimension breakdowns, evidence refs, confidence, flags, and integrity adjustments — with Zod validation, SQL storage, and multi-judge reconciliation logic.

Multi-tenancy patterns — shared schema with RLS, schema-per-tenant, tenant context propagation, team/role management, billing per tenant, and isolation testing.

Detection and exploitation understanding of JavaScript prototype pollution vulnerabilities, from source identification through gadget chains to RCE. Use when reviewing code that merges objects, parses JSON, uses lodash/underscore deep operations, processes GraphQL responses, handles deserialization (React Flight, devalue, flatted), or any code where user input flows into object property assignment. Covers CVE-2025-13465 (Lodash), CVE-2025-55182 (React2Shell via pollution), CVE-2026-30226 (Svelte devalue), CVE-2026-33228 (flatted), CVE-2026-12345 (Apollo Federation CRITICAL). Essential for Next.js + Supabase stack review.

Run automated WCAG 2.1 AA accessibility checks on every Arena page using axe-core via @axe-core/playwright. Identifies critical violations that block launch vs serious issues to fix soon. Integrated into Forge's E2E flow.

Detection of business logic vulnerabilities — the bugs that scanners never find. Use when reviewing payment flows, subscription management, resource allocation, competitions/contests, coupon/discount systems, multi-step workflows, role/permission transitions, approval processes, or any feature where the correctness of behavior depends on business rules rather than technical implementation. Covers IDOR (Insecure Direct Object References), state machine violations, parameter tampering, price/quantity manipulation, privilege escalation via logic flaws, workflow bypass, and financial calculation errors. Relevant for Agent Arena, UberKiwi, and any product with money, permissions, or competitive mechanics.

Security compliance requirements for financial services applications — SOC 2, PCI DSS, GDPR/privacy, and financial data handling standards. Use when building payment products, financial SaaS, mortgage/lending tools, or any application handling financial data, PII, or payment card information. Covers what SOC 2 Type II requires from a technical security standpoint, PCI DSS scope reduction (so you don't have to become PCI compliant yourself), GDPR technical requirements, breach notification obligations, data retention rules, and the specific audit controls that map to our Next.js + Supabase architecture.

Using crypto correctly — hashing, HMAC, encryption, JWT internals, and review flags for cryptographic anti-patterns.

Practical data structures for production code — Map for O(1) lookups, Set for membership, trees for hierarchies, queues for job scheduling. Not LeetCode — real patterns.

ELO deep dive, Glicko-2 rating system, matchmaking algorithms, tournament bracket generation, and anti-gaming detection for Agent Arena.

Render partial, legacy, missing, and evolving evaluation result data without crashes — covering every null/undefined edge case in Bouts lane scores, evidence refs, confidence fields, and partial judge results.

Design the Bouts post-match breakdown page — information hierarchy, component architecture, partial result handling, loading states, mobile/desktop layout, and psychological flow that makes users feel the result is trustworthy and earned.

Systematic threat modeling using STRIDE, attack trees, and data flow analysis — applied BEFORE code is written to catch security flaws at design time. Use when designing new features, reviewing architecture specs, evaluating system designs, creating security requirements for new projects, or performing pre-development security review. This is the proactive counterpart to reactive code review — find the vulnerability in the design before anyone writes a line of code. Covers STRIDE threat categorization, data flow diagramming, trust boundary identification, attack tree construction, risk scoring, and threat-to-mitigation mapping specific to our Next.js + Supabase + Vercel stack.

Type-level programming — discriminated unions, generics mastery, branded types, utility types, end-to-end type safety patterns for Next.js + Supabase.

How to make dense evaluation output readable fast — the 3-second rule, progressive disclosure architecture, scan-first layout, expandable evidence panels, and concrete before/after redesign for Bouts result pages.