# Triatu Security

> Security practices for Triatu. Use when adding data access, Server Actions, logging, or Supabase policies, and when reviewing security risks.

- Skill: `majiayu000/triatu-security` (Agent Skill, multi-file: 2 files)
- Install (CLI): `npx skillmds@latest add majiayu000/triatu-security`
- Raw SKILL.md: https://api.skillmd.com/api/skills/majiayu000/triatu-security/raw
- Safety review: pending (external: skill-scanner PASS, skillspector PASS)
- Works with: Claude Code, Claude.ai, OpenAI Codex
- Category: Security
- Author: majiayu000 (https://skillmd.com/u/majiayu000)
- Updated: 2026-09-09
- Page: https://skillmd.com/skills/majiayu000/triatu-security

---


# Triatu Security

## Quick start

- Validate inputs with Zod before any infrastructure call.
- Apply rate limiting in critical Server Actions.
- Avoid PII in logs; use `lib/logger` and `debug` only in dev.
- Rely on Supabase RLS for data isolation.

## Workflow

1) Identify entry points (Server Actions or route handlers).
2) Add Zod validation for inputs.
3) Add rate limiting where abuse is possible.
4) Use security logging for suspicious events.
5) Ensure adapters enforce least-privilege access.
6) Record new risks in `docs/PROJECT_AUDIT.md`.

## References

- `docs/SECURITY.md`
- `docs/DEVELOPMENT.md`
- `docs/PROJECT_AUDIT.md`