| name | zai-security |
| description | Master skill for DevSecOps, Zero Trust, WAF, and AgentShield |
Language and Coding Standards
- Communication: Always talk in Thai when interacting with users.
- Code & Technical Assets: All code, comments, documentation, and technical definitions must be in English.
zai-security
ZeaZ Platform & apps/* Monorepo Rules
When implementing tasks on the zeaz-platform repository, you MUST strictly enforce these architecture and workflow rules:
- Monorepo Architecture (apps/*): The platform is a unified monorepo. ALL applications, microservices, frontends, and AI toolings (e.g., zLinebot, zwallet, zdash) reside inside the
apps/ directory. Do not create top-level directories for apps. When refactoring or adding features, always scope your work to the specific apps/<app-name>/ folder.
- Environment Variables: Avoid scattering
.env files. Consolidate environment variables into a central .env.example inside the respective app folder. Canonical Cloudflare variables (e.g. CLOUDFLARE_API_TOKEN, CLOUDFLARE_ZONE_ID) MUST be used instead of legacy CF_ variants.
- Commit Workflow: NEVER use
git commit or git push directly. ALWAYS stage your intended files with git add and commit using make gpg-finalize COMMIT_MSG="..." from the repository root to ensure all GitOps and DevSecOps checks pass.
- Security: NEVER commit or generate real secrets. Unsafe placeholders like
test-secret-value-value-value, test-secret-value-value-value, test-secret-value-value-value are FORBIDDEN.
- Language: Code, documentation, and technical definitions MUST be in English.
ZAI Security & Zero Trust
Focuses on securing the ZeaZ platform using Cloudflare Zero Trust, API Shield, WAF rules, and DevSecOps best practices. Ensures all secrets, credentials, and CI/CD pipelines meet the strict no-hardcode policies.