Synthex security posture enforcer. NEVER apply generic OWASP checklists without grounding in Synthex's specific threat model. NEVER suggest any auth system other than Supabase. ALWAYS audit: SSRF via validateExternalUrl, JWT tier elevation via resolveVerifiedTier, CORS via CORS_ORIGIN exact-match, org-scope bypass in Prisma. Activate on ANY request to harden security, audit vulnerabilities, review auth patterns, check for injection risks, or assess an attack surface.
Synthex security posture enforcer. NEVER apply generic OWASP checklists without grounding in Synthex's specific threat model. NEVER suggest any auth system other than Supabase. ALWAYS audit: SSRF via validateExternalUrl, JWT tier elevation via resolveVerifiedTier, CORS via CORS_ORIGIN exact-match, org-scope bypass in Prisma. Activate on ANY request to harden security, audit vulnerabilities, review auth patterns, check for injection risks, or assess an attack surface.
Proactive security scan that covers the full security surface of the SYNTHEX
platform. While route-auditor checks individual API routes, this skill checks
the infrastructure-level security posture: build configuration, secret
management, HTTP headers, rate limiting, cookie policies, dependency health,
and type safety.
A senior engineer reviews these before every production deployment. This skill
automates that review so nothing slips through regardless of who (or what AI)
is writing the code.
When to Use
Activate this skill when:
Preparing for a production deployment
After modifying next.config.mjs, middleware.ts, or security-related files
Running a periodic security audit
Onboarding to understand the security baseline
After adding new dependencies
Before a security review or compliance check
When NOT to Use
For individual API route compliance (use route-auditor)
For architecture pattern enforcement (use architecture-enforcer)
For database security (use sql-hardener or database-prisma)
Build: next.config.mjs with strict TypeScript enforcement
Deploy: Vercel serverless
Pre-Scan: Extract Public Route Surface
Before running any security checks, extract the verified list of public (unauthenticated) routes from the route reference. This is the authoritative starting surface for the auth audit — no ad-hoc filesystem scan needed.
grep "— public" .planning/ROUTE_REFERENCE.md
If the output looks stale (e.g., routes you recently added are missing), run npm run routes:refresh first to regenerate Zone 1.
Use this list for:
S3 secret exposure scan scoping (public routes are highest risk)
S6 rate limiting check (public routes most need rate limiting)
Manual review: any public route without a documented reason to be public is a finding
Security Checks
CRITICAL (Deployment Blockers)
S1: Build Configuration Integrity
Rule:ignoreBuildErrors and ignoreDuringBuilds must be false in next.config.mjs.
Why: Setting these to true masks TypeScript errors that can hide security vulnerabilities, null pointer exceptions, and type confusion bugs.
Check:
Expected: Both set to false.
Fix: Set both to false and resolve all TypeScript errors.
S2: Type Safety Gate
Rule:npx tsc --noEmit must pass with 0 errors.
Why: TypeScript errors can mask security issues. A function expecting string receiving any can lead to injection vulnerabilities.
Check:
npx tsc --noEmit 2>&1 | tail -1
Expected: "Found 0 errors."
S3: Secret Exposure Scan
Rule: No hardcoded secrets, no fallback values for critical environment variables.
Anti-patterns:
Rule:middleware.ts must set Content-Security-Policy with at minimum:
default-src 'self'
script-src (no unsafe-inline in production)
style-src (Tailwind needs unsafe-inline)
img-src (allow CDN domains)
connect-src (API domains)
frame-ancestors 'none'Check: Read middleware.ts and verify CSP directive completeness.
S6: Rate Limiting on Auth Endpoints
Rule: Authentication endpoints must have rate limiting configured.
Endpoints to check:/api/auth/login, /api/auth/register, /api/auth/forgot-passwordCheck: Verify these routes use APISecurityChecker with rate limiting or lib/rate-limit/rate-limiter.ts.
NEVER run a theoretical OWASP scan without a concrete attack vector for
this specific codebase. Never suggest auth systems other than Supabase.
Never flag issues that the codebase already handles correctly as if they
were open vulnerabilities.
INSTEAD audit against Synthex's known attack surfaces in priority order:
SSRF — user-supplied URLs must go through validateExternalUrl() from
lib/security/validate-url before any fetch() call
JWT tier elevation — tier must be resolved via resolveVerifiedTier()
with Redis cache TTL, never decoded from unverified JWT payload directly
CORS — CORS_ORIGIN env var exact-match allowlist in middleware.ts,
never origin.includes(hostname) substring match
Org-scope bypass — every Prisma query must have organizationId filter;
a query returning data without org filter is a data leak
OAuth open redirect — returnTo must start with /, not // or ://
