菜单
Security review checklist for ZeeKayDa.Auth. Apply to every change touching tokens, cryptography, endpoints, or storage — during security review, and as a developer self-check before opening a PR that touches those areas.
用 Codex 或 Claude 帮你安装 复制这段 Prompt，粘贴到 Codex、Claude 或其他助手里，让它检查 Skill 页面并帮你完成安装。
基于 SOC 职业分类
| name | security-checklist |
| description | Security review checklist for ZeeKayDa.Auth. Apply to every change touching tokens, cryptography, endpoints, or storage — during security review, and as a developer self-check before opening a PR that touches those areas. |
Apply this checklist to every auth-related change. It is the shared reference for the security agent's reviews and the developer's pre-PR self-check.
Random, use RandomNumberGenerator)state parameter validated to prevent CSRFiss claim validated in token responses (RFC 9207)Compare test coverage on the current branch against main and fail if it regressed. Run before opening any PR — CI enforces a coverage regression gate, and this catches it locally first.
LSP-first code navigation for ZeeKayDa.Auth — load the LSP tool up front and use it for all symbol-level lookups. Applies to every agent that reads or writes C# in this repository.
Verify and fix code formatting with dotnet format. Run before opening any PR, and whenever formatting errors are reported by CI or the Stop hook.
Housekeeping after a PR merges — delete the local branch, pull main, remove resolved blockers from draft PRs and issues, and check whether the parent epic can close. Run whenever a PR has been merged.
Write a well-structured GitHub issue for ZeeKayDa.Auth — decides between an ADR issue and an implementation issue, applies the issue templates, hierarchy, and labels, and links sub-issues to their epic. Use when fleshing out a new idea, filing a bug, creating design or implementation issues, or triaging incoming issues.
Set up a git worktree for reviewing or auditing a branch or PR so the review runs against the right code. Use before any code review, audit, or acceptance-criteria verification that targets a branch other than the currently checked-out one.