# Security Audit

> Checklist for security-sensitive coding, ensuring MaiHouses guards and policies are respected.

- Skill: `majiayu000/security-audit-6` (Agent Skill, multi-file: 2 files)
- Install (CLI): `npx skillmds add majiayu000/security-audit-6`
- Raw SKILL.md: https://api.skillmd.com/api/skills/majiayu000/security-audit-6/raw
- Safety review: pending
- Works with: Claude Code, Claude.ai, OpenAI Codex
- Category: Security
- Author: majiayu000 (https://skillmd.com/u/majiayu000)
- Updated: 2026-09-09
- Page: https://skillmd.com/skills/majiayu000/security-audit-6

---


# Security Audit Protocol

## 1. Critical "Guard" Files

**WARNING**: The following files are **OFF-LIMITS** for modification without explicit user approval.

- `scripts/ai-diff-gate.ts`
- `.github/workflows/**`
- Any file with `midlaw` or `policy` in the name.

## 2. Database Security (Supabase)

- **RLS (Row Level Security)**:
  - EVERY table must have RLS enabled.
  - Policies must explicitly define `USING` and `WITH CHECK` clauses.
  - NEVER use `service_role` key in frontend client code.
- **SQL Injection**:
  - Use parameterized queries or ORM methods (Supabase JS client) only.
  - Avoid raw SQL string concatenation.

## 3. API Security

- **Authentication**:
  - Verify `user` exists in `req` (usually populated by middleware/auth helper).
  - Check permissions before performing actions (e.g. `checkPermission(user.id, 'post.create')`).
- **Input Validation**:
  - Validate ALL inputs using `zod` schemas.
  - Sanitize HTML inputs if rendering user content (use `DOMPurify`).

## 4. Audit Checklist

- [ ] Are guards/policies untouched?
- [ ] Is RLS enabled and tested?
- [ ] Is input validation (`zod`) in place?
- [ ] Are no secrets committed to code?
- [ ] Did I run `/security-review` (if available) or manual check?