Skill UI

This skill provides comprehensive guardrails for securing Replit-hosted applications. It covers critical security policies including preventing hardcoded secrets, implementing resource usage limits (CPU/Memory), enforcing endpoint authentication, and ensuring proper deployment configuration. Use this when you need to harden a Replit app for production or audit its security posture.

A comprehensive guide detailing security best practices for building and deploying applications on the Replit platform. Learn how to properly manage sensitive data using Replit Secrets (AES-256 encryption), implement secure service-to-service authentication via REPL_IDENTITY tokens, validate custom headers, and prevent common vulnerabilities like hardcoded API keys and SQL injection. Essential for auditing and securing production environments.

This skill provides foundational security patterns and implementation guides for building AI voice agents and automating phone call workflows using Retell AI. It covers essential SDK usage (TypeScript), agent listing, and critical error handling (e.g., 401 Unauthorized, 429 Rate Limit) when integrating Retell into voice or telephony applications.

A comprehensive tool for detecting critical API security vulnerabilities, including injection, broken authentication (BOLA), excessive data exposure, and mass assignment. It audits endpoints against the OWASP API Security Top 10 standards by analyzing source code, middleware chains, and request validation logic. Ideal for pre-deployment security gates, CI/CD integration, and compliance audits.

A comprehensive, multi-phase workflow designed for conducting deep security audits across modern web applications and APIs. This bundle guides users through the entire security lifecycle, including reconnaissance, vulnerability scanning (SAST/DAST), specific testing for OWASP Top 10 and injection flaws, specialized API fuzzing, full-scope penetration testing, security hardening, and final risk reporting. Ideal for compliance checks and proactive security enhancement.

Provides authentication, authorization, encryption, secrets, and hardening patterns for designing secure auth flows, managing tokens, configuring CORS, and implementing best practices around API keys, JWT, OAuth, and rate limiting.

Provides comprehensive security review guidance for authentication, input handling, secrets, APIs, and payment-sensitive workflows, with actionable checklists covering secrets, validation, SQL injection, auth, XSS, CSRF, rate limits, and sensitive data handling.

This skill implements a robust, multi-layered security hardening process based on the Defense-in-Depth strategy and DevSecOps principles. It coordinates specialized agents to perform comprehensive security assessments (SAST, DAST, SBOM, Threat Modeling), identify critical vulnerabilities, and execute layered remediation. The process covers application code, backend APIs, frontend components, and mobile platforms, ensuring a resilient security posture across the entire development lifecycle.

A comprehensive toolkit for the full software development lifecycle. It guides stack selection using a detailed decision engine, automatically scaffolds complex boilerplate projects across multiple popular stacks (Next.js, MERN, FastAPI, Django), and provides deep code quality analysis. Features include security vulnerability detection, complexity scoring, and dependency auditing, ensuring high-quality development from the start.

This comprehensive guide details how to harden Sentry's security posture and ensure compliance with regulations like GDPR. It covers best practices for managing sensitive data, implementing PII scrubbing, and configuring `beforeSend` hooks to automatically redact sensitive information such as passwords, API keys, tokens, IP addresses, and emails from client-side and server-side events.

A specialized methodology for reviewing APIs, configuration schemas, and interfaces to identify 'footguns'—design choices where the path of least resistance leads to insecurity. This analysis focuses on making secure usage the default, covering topics like dangerous defaults, primitive vs. semantic type safety, and insecure algorithm selection. It is crucial for architects and reviewers to prevent developer misuse at the design level.

This guide outlines essential security best practices for integrating the Speak API. It covers critical areas like securing API keys using secrets managers, ensuring audio data privacy by deleting local files, and maintaining compliance with major regulations such as COPPA and FERPA. Use this knowledge when building production-ready, secure language learning applications.