Skill UI

This comprehensive guide details how to harden Sentry's security posture and ensure compliance with regulations like GDPR. It covers best practices for managing sensitive data, implementing PII scrubbing, and configuring `beforeSend` hooks to automatically redact sensitive information such as passwords, API keys, tokens, IP addresses, and emails from client-side and server-side events.

This comprehensive guide provides step-by-step instructions for setting up a complete connection to a Supabase backend. It covers installing the necessary SDKs (for TypeScript and Python) and the CLI, securely configuring environment variables (URL, anon key, service role key), and initializing the client singleton for both client-side and server-side applications. Essential for new project development and authentication integration.

A comprehensive guide for developers on handling sensitive data and ensuring compliance with major privacy regulations like GDPR and CCPA when deploying serverless functions on Vercel. Learn techniques for PII redaction in logs, implementing data subject rights (Right to Access/Erasure), securing session cookies, and configuring data residency to meet global privacy standards.

This comprehensive guide details how to establish secure and robust API endpoints using Expo Router and EAS Hosting. Learn best practices for handling server-side secrets (API keys, credentials), proxying third-party services (like OpenAI), executing secure database operations, and implementing complex business logic entirely on the server. It covers file structure, HTTP methods, and deployment to Cloudflare Workers.

Generate and debug server-side QWeb XML for Odoo PDF reports, emails, and website pages, with correct directives, translations, and report action bindings.

This tool provides a comprehensive framework for analyzing web server logs (Apache/Nginx) to detect various security threats. It uses advanced regex matching against OWASP attack signatures to identify SQL injection, Local File Inclusion, and Directory Traversal attempts, alongside behavioral analysis for brute-force attacks and web scanner fingerprints. The system also enriches data using GeoIP for source attribution, generating a prioritized report for SOC analysts.

This skill guides the detection and exploitation of JavaScript prototype pollution vulnerabilities. It covers both client-side (DOM XSS) and server-side (RCE, Auth Bypass) attacks by injecting properties into Object.prototype using keys like `__proto__`. Use this when assessing APIs that deep-merge or clone user-controlled JSON data, or for general web application security testing.

A comprehensive guide detailing the methodology for identifying and exploiting Server-Side Request Forgery (SSRF). This technique is critical in authorized penetration testing, allowing attackers to pivot from public-facing applications to internal resources. Use cases include stealing cloud provider metadata (AWS, GCP), scanning private IP ranges, and accessing internal APIs and admin panels.

This guide details the comprehensive methodology for detecting and exploiting Server-Side Template Injection (SSTI) vulnerabilities across multiple popular template engines, including Jinja2, Twig, and Freemarker. It provides step-by-step workflows, covering payload detection using basic arithmetic expressions, engine identification, and executing advanced Remote Code Execution (RCE) payloads for penetration testing purposes.

This comprehensive guide details robust techniques for managing the entire API key lifecycle. It mandates secure key generation with high entropy, server-side hashing (SHA-256/bcrypt) to prevent plaintext storage, and implements granular controls like per-key scoping (endpoints, IPs, rate limits). Key features include zero-downtime key rotation workflows and automated monitoring for key leakage across code repositories and logs. Ideal for server-to-server API authentication.

A comprehensive guide detailing techniques for detecting and exploiting Blind Server-Side Request Forgery (SSRF). It uses advanced out-of-band (OOB) techniques, such as Burp Collaborator and timing analysis, to interact with internal services, scan private IP ranges, and extract cloud metadata (AWS, GCP, Azure) even when the application does not reflect the server response directly. Essential for web application penetration testing.

This tool automates the testing of web application URL parameters for Server-Side Request Forgery (SSRF). It probes sensitive endpoints, including cloud metadata services (AWS, GCP, Azure), internal network resources, and various URI schemes (file://, gopher://). It is designed for authorized penetration testing environments to confirm SSRF vulnerabilities and generate detailed threat reports.