Menu
Use when adding Supabase Edge Functions, Stripe/webhook handlers, server-side secrets, or API routes that must not run in the browser. Not for client-only UI, CSS, or simple CRUD that RLS + client can handle safely.
Installer avec Codex ou Claude Copiez ce prompt, collez-le dans Codex, Claude ou un autre assistant, puis laissez-le vérifier la page du skill et l'installer pour vous.
Basé sur la classification professionnelle SOC
Use when reviewing or fixing accessibility: keyboard navigation, focus order, labels, color contrast, screen reader support, or ARIA attributes. Not for SEO-only or performance-only audits.
Use when adding product analytics (PostHog, GA4, Plausible), event tracking, funnels, or conversion measurement. Not for server logs only or A/B infra unless events are part of the task.
Use when standardizing API and edge function errors: HTTP status codes, error JSON shape, logging, or mapping Supabase/Stripe errors to client responses. Not for UI toast copy only or form field validation messages.
Use when recording audit trails: who changed what, admin action logs, compliance history, or append-only event tables. Not for product analytics (use analytics-events) or debug console logs only.
Use when scheduling background work: cron jobs, digest emails, cleanup tasks, pg_cron, Supabase scheduled edge functions, or job queues. Not for synchronous user-facing API in the request path.
Use when adding dark mode, theme toggle, system theme support, or fixing hardcoded colors that break in dark mode. Not for design-token migration unrelated to dark mode.
| name | edge-functions-and-webhooks |
| description | Use when adding Supabase Edge Functions, Stripe/webhook handlers, server-side secrets, or API routes that must not run in the browser. Not for client-only UI, CSS, or simple CRUD that RLS + client can handle safely. |
Secrets and trusted third-party callbacks belong in Supabase Edge Functions (or equivalent server), never in the Vite client bundle.
supabase/functions/
stripe-webhook/
index.ts
send-email/
index.ts
Deno.env.get("STRIPE_WEBHOOK_SECRET") etc. — set in Supabase dashboard, not in repo.400 invalid payload, 401 bad signature, 200 success.event.type; update DB with service client.For full Stripe event matrix, idempotency, and testing, use stripe-payment-webhooks, payment-webhook-idempotency, and payment-webhook-testing.
supabase.functions.invoke("send-email", { body: { ... } }) only for operations safe for authenticated users.auth.getUser() inside the function for user-triggered calls.VITE_STRIPE_SECRET_KEY, VITE_SERVICE_ROLE, or webhook secrets in frontend.For any non-trivial edge function, also apply:
server-input-validation — Zod on every bodyapi-error-handling — consistent JSON errors and status codesserver-input-validation).api-error-handling).Deno.env.get(...); never logged.