메뉴
Security review checklist for ZeeKayDa.Auth. Apply to every change touching tokens, cryptography, endpoints, or storage — during security review, and as a developer self-check before opening a PR that touches those areas.
Codex 또는 Claude로 설치 이 Prompt를 복사해 Codex, Claude 또는 다른 어시스턴트에 붙여 넣으면 Skill 페이지를 검토하고 설치를 진행할 수 있습니다.
SOC 직업 분류 기준
Compare test coverage on the current branch against main and fail if it regressed. Run before opening any PR — CI enforces a coverage regression gate, and this catches it locally first.
LSP-first code navigation for ZeeKayDa.Auth — load the LSP tool up front and use it for all symbol-level lookups. Applies to every agent that reads or writes C# in this repository.
Verify and fix code formatting with dotnet format. Run before opening any PR, and whenever formatting errors are reported by CI or the Stop hook.
Housekeeping after a PR merges — delete the local branch, pull main, remove resolved blockers from draft PRs and issues, and check whether the parent epic can close. Run whenever a PR has been merged.
Write a well-structured GitHub issue for ZeeKayDa.Auth — decides between an ADR issue and an implementation issue, applies the issue templates, hierarchy, and labels, and links sub-issues to their epic. Use when fleshing out a new idea, filing a bug, creating design or implementation issues, or triaging incoming issues.
Set up a git worktree for reviewing or auditing a branch or PR so the review runs against the right code. Use before any code review, audit, or acceptance-criteria verification that targets a branch other than the currently checked-out one.
| name | security-checklist |
| description | Security review checklist for ZeeKayDa.Auth. Apply to every change touching tokens, cryptography, endpoints, or storage — during security review, and as a developer self-check before opening a PR that touches those areas. |
Apply this checklist to every auth-related change. It is the shared reference for the security agent's reviews and the developer's pre-PR self-check.
Random, use RandomNumberGenerator)state parameter validated to prevent CSRFiss claim validated in token responses (RFC 9207)