Menu
Use when auth, env, secrets, fail-closed behavior, or sensitive API routes make a Hushhtech PR risky to patch or merge.
Install with Codex or Claude Copy this prompt, paste it into Codex, Claude, or another assistant, and let it review the skill page and install it for you.
Based on SOC occupation classification
Use when deploying the HushhTech web app to UAT or PROD, triggering the deploy-uat / deploy-prod GitHub Actions workflows, picking a safe "green main" SHA to ship, or when deployments feel slow and you want to cut the CI/CD cycle time. Trigger this whenever the user mentions deploying, shipping, releasing, pushing to UAT / prod / Cloud Run, a slow build or deploy pipeline, or asks how to make deploys faster — even for tiny changes. Covers the exact deploy procedure, the safety gates, the full pipeline anatomy, and a prioritized playbook of levers to reduce deploy time.
Use when deciding which checks are authoritative for a Hushhtech PR and whether the right proof exists for the changed behavior.
Use when working on Hushhtech PR checks, CI/CD, branch protection, merge queue, deploys, env parity, or operational verification.
Use whenever a task involves Supabase for this repo — editing or deploying edge functions, changing edge-function secrets, running migrations, or auditing Supabase dashboard config. Prefer the Supabase CLI for writes when the user has explicitly asked for deployment and the target project/ref is confirmed. If CLI is blocked, fall back to the user's Chrome session on port 9223 where ankit@hushh.ai is logged in. Trigger on any mention of Supabase edge functions, secrets, migrations, or "deploy create-link-token / an edge function".
Use whenever a task involves Supabase for this repo — editing or deploying edge functions, changing edge-function secrets, running migrations, or auditing Supabase dashboard config. Prefer the Supabase CLI for writes when the user has explicitly asked for deployment and the target project/ref is confirmed. If CLI is blocked, fall back to the user's Chrome session on port 9223 where ankit@hushh.ai is logged in. Trigger on any mention of Supabase edge functions, secrets, migrations, or "deploy create-link-token / an edge function".
Use when deploying the HushhTech web app to UAT or PROD, triggering the deploy-uat / deploy-prod GitHub Actions workflows, picking a safe "green main" SHA to ship, or when deployments feel slow and you want to cut the CI/CD cycle time. Trigger this whenever the user mentions deploying, shipping, releasing, pushing to UAT / prod / Cloud Run, a slow build or deploy pipeline, or asks how to make deploys faster — even for tiny changes. Covers the exact deploy procedure, the safety gates, the full pipeline anatomy, and a prioritized playbook of levers to reduce deploy time.
| name | security-audit |
| description | Use when auth, env, secrets, fail-closed behavior, or sensitive API routes make a Hushhtech PR risky to patch or merge. |
security-audit-intakerepo-operations, repo-context, and broad product implementation.ownersecurity-auditOwned repo surfaces:
src/authsrc/resources/configapi/delete-account-service.jsapi/delete-account.jsapi/public-investor-profile.jsapi/send-email-notification.jsapi/gemini-ephemeral-token.jsapi/google-wallet-pass.jsapi/wallet-pass.jsdocs/HUSHH_TECH_SECRET_RUNBOOK.mddocs/OPEN_SOURCE_SECRET_AUDIT.mddocs/HUSHH_TECH_SECURITY_AUDIT.mdNon-owned surfaces:
repo-operationsoss-contribution-triagefrontendbackendRequest changes or Discard/close.SECURITY.mddocs/HUSHH_TECH_SECRET_RUNBOOK.mddocs/OPEN_SOURCE_SECRET_AUDIT.mddocs/HUSHH_TECH_SECURITY_AUDIT.mdscripts/ci/check-env-contract.mjsoss-contribution-triage.repo-operations.quality-contracts.npm run env:check
npm run security:gitleaks
npm run security:audit
npm run test -- tests/communityApiRoute.test.ts tests/communityGcpRuntime.test.ts
npm run verify:sensitive-nda-gate -- --target=uat