# Masoi Perf Security

> Audit Ma Sói server and client for performance bottlenecks, memory leaks, security vulnerabilities, rate limiting, input validation, CORS policy, timer cleanup, and room zombie detection. Use when changing socket handlers, setTimeout/setInterval patterns, Redis/PostgreSQL queries, authentication, or deploying to production.

- Skill: `nobodyonlyc/masoi-perf-security` (Agent Skill, multi-file: 3 files)
- Install (CLI): `npx skillmds@latest add nobodyonlyc/masoi-perf-security`
- Raw SKILL.md: https://api.skillmd.com/api/skills/nobodyonlyc/masoi-perf-security/raw
- Safety review: pending
- Works with: Claude Code, Claude.ai, OpenAI Codex
- Category: Security
- Author: nobodyonlyc (https://skillmd.com/u/nobodyonlyc)
- Updated: 2026-09-17
- Page: https://skillmd.com/skills/nobodyonlyc/masoi-perf-security

---


# Ma Sói Performance & Security Auditor

## Workflow

1. Read `server/index.js` for socket handlers, timer patterns, and room lifecycle.
2. Read `server/db/redis.js` and `server/db/postgres.js` for data access patterns.
3. Read `server/gameEngine.js` for input validation in role assignment.
4. Check the change against `references/security-checklist.md`.
5. After edits, verify:
   - `node --check server/index.js`
   - `node --check server/gameEngine.js`
   - `cd client && npm run build` if client changed.

## Security Rules

- Never trust client-sent `userId` without server-side validation against socket session.
- All socket event handlers must validate room existence, player membership, and phase before acting.
- Rate limit socket events to prevent spam and DDoS (especially `send_message`, `night_action`, `cast_vote`).
- Production must NOT use `cors: { origin: '*' }` — restrict to known domains.
- Bcrypt salt rounds should be at least 10 (currently OK).
- Never expose full room state including all player roles to non-admin clients.

## Performance Rules

- Every `setTimeout` must be cancellable and tracked — stale timers from old rounds must not fire.
- Room zombie detection: rooms with all players disconnected should be cleaned up within a bounded time.
- Redis `saveRoom` calls should be batched or debounced where possible to reduce write pressure.
- `roomLocks` Map must not grow unbounded — ensure cleanup after lock release.
- Client `setInterval` for timer countdown must be cleared on component unmount and phase change.
- Wolf chat and public chat arrays are capped at 200 — verify no unbounded growth paths.

## Common Vulnerability Patterns

- Forged `userId` in socket events bypassing auth.
- Concurrent `resolveNight` / `resolveVote` causing double kills or double state transitions.
- Timer stacking: multiple `scheduleNight` or `scheduleVote` calls for the same round.
- Room state corruption from race conditions in `withRoomLock` edge cases.
- Stale `user:{id}:room` mappings blocking room creation/joining.

## References

Load `references/security-checklist.md` when auditing security or performance.