# Ivx Qv Security

> Audit authentication, token handling, PII protection, and anti-cheat in QuizVerse.

- Skill: `intelli-verse-x/ivx-qv-security` (Agent Skill, multi-file: 2 files)
- Install (CLI): `npx skillmds add intelli-verse-x/ivx-qv-security`
- Raw SKILL.md: https://api.skillmd.com/api/skills/intelli-verse-x/ivx-qv-security/raw
- Safety review: pending (external: skill-scanner PASS, skillspector PASS)
- Works with: Claude Code, Claude.ai, OpenAI Codex
- Category: Security
- Author: intelli-verse-x (https://skillmd.com/u/intelli-verse-x)
- Updated: 2026-08-19
- Page: https://skillmd.com/skills/intelli-verse-x/ivx-qv-security

---


## When to Use
"security", "auth", "token", "credential", "hack", "cheat", "PII", "encryption"

## Audit Checklist
```
1. Secrets → no hardcoded keys, tokens, or URLs in source
2. Auth → device + custom + Cognito flow validated
3. PII → SecureLogger.MaskEmail() for all user data
4. Network → HTTPS only, certificate pinning on mobile
5. Economy → server-authoritative (Nakama wallet), no client trust
6. Anti-cheat → validate scores server-side, rate-limit RPCs
```

## Guardrails
- `SecureLogger.MaskEmail()` for PII in logs
- HTTPS everywhere (no HTTP)
- Server-authoritative rewards/scores (never trust client)
- No `.Result` on Task → use `GetResultSafe()`

## Context Files (load only if needed)
- Workflow: `.agents/workflows/security.md`
- Persona: `.agents/personas/security-architect.md`
- Auth API: `docs/context/micro/AUTH_INTERFACE.md` (1.4 KB)