security-pentest

name	security-pentest
description	Periodic penetration testing suite. Covers web app (Next.js), REST API (Go/Gin), and deployment surface. Use before every major release and quarterly thereafter. Complements wtf-security (code review) with black-box dynamic testing.

security-pentest

Black-box dynamic pentest. Complements wtf-security (static code review). Three sub-skills, run in parallel before every major release and quarterly:

• security-pentest/web-app-pentest — Next.js frontend flows.
• security-pentest/api-pentest — Go REST API (JWT, IDOR, rate limiting, business logic).
• security-pentest/network-pentest — TLS, headers, exposed ports, DNS.

Findings → GitHub issues under the Phase S: Security Hardening milestone. CRITICAL → hotfix branch immediately.

This skill family was inspired by mukul975/Anthropic-Cybersecurity-Skills.