Pentest de backend NestJS — OWASP API Security Top 10 (2023). Cobre BOLA/IDOR, autenticação quebrada, mass assignment, SSRF, prototype pollution, injeção SQL/NoSQL, RCE via upload, race conditions (TOCTOU), JWT alg confusion, rate-limit, CORS, helmet, lógica de negócio e autorização por recurso. TRIGGERS: pentest backend, pentest nestjs, pentest api, api security, owasp api, bola, idor, mass assignment, ssrf, prototype pollution, jwt alg none, rate limit, cors misconfig, nestjs guards, nestjs security
Pentest de mobile React Native — OWASP MASVS L1/L2 + Mobile Top 10 (2024). Cobre insecure storage, SSL pinning, root/jailbreak, deeplink hijack, WebView injection, Hermes bytecode, OTA updates (Expo/CodePush), Frida hooks, anti-tamper e app signing. TRIGGERS: pentest mobile, pentest react native, react native security, masvs, mobile top 10, ssl pinning, deeplink, jailbreak detection, hermes, expo updates, mobile storage, android manifest, ios plist
Pentest de supply chain, CI/CD e infraestrutura — SCA/CVE, typosquatting, malicious postinstall, GitHub Actions (pinning por SHA, permissões, script injection, pwn-request), Docker (imagem base, rootless, secrets em layer), lockfile poisoning, SBOM, gestão de secrets e GitOps. TRIGGERS: supply chain, sca, cve, github actions security, docker security, sbom, dependabot, codeql, typosquat, postinstall malicious, lockfile, pin dependencies, renovate, secret management
Pentest de frontend Angular (Web) — OWASP Top 10 2025, DOM security, XSS, CSRF, CSP, template injection, sanitização, storage de tokens, open redirect, clickjacking, cache poisoning. TRIGGERS: pentest web, pentest angular, angular security, xss angular, csp angular, frontend security, dom xss, bypass security trust, angular storage, cookie httponly
Architecture Review - Avalia decisões arquiteturais geradas por IA: tradeoffs, confiabilidade (testes de falha) e contingências (disaster recovery). TRIGGERS: architecture review, revisar arquitetura, tradeoffs, confiabilidade, failure test, teste de falha, resilience, chaos engineering, contingência, disaster recovery, fallback, circuit breaker, banco fora, validar arquitetura, relatório completo, arquiteto sênior
Performance Audit - Detecta problemas de performance gerados por IA em código Angular/NestJS: N+1 queries, race conditions e memory leaks. TRIGGERS: audit performance, performance review, detectar N+1, race condition, memory leak, vazamento de memoria, relatório completo, validar performance, performance report, concurrency issue, subscription leak, queries redundantes
Security & Pentest Audit - Valida segurança de código gerado por IA: security lint, secret scan, scan de vulnerabilidades em dependências e pinagem de versões. TRIGGERS: pentest, security review, audit security, security scan, scan de segurança, secret scan, vazamento de credenciais, exploit lib, vulnerabilidade, SAST, pinar dependências, lockfile, validar segurança, relatório completo, github actions security
Deep Architecture Health Check - Comprehensive audit using all 19 architecture knowledge base documents. Validates clean architecture layers, DDD compliance, type safety, reactive patterns, error handling, and more. TRIGGERS: arch doctor, architecture health, deep audit, architecture check, full audit, health check, architecture score