「auth」の検索結果

Test application security against OWASP Top 10 (2025) with automated CI tooling: OWASP ZAP (DAST), dependency/supply-chain scanning (OSV-Scanner, SBOM, provenance), Semgrep SAST, auth/session tests (JWT, OAuth, RBAC), and XSS/CSRF/SQLi/SSRF Playwright patterns. Use when: "security test," "OWASP," "vulnerability," "ZAP," "XSS," "SSRF," "dependency scan," "auth testing," "OWASP LLM Top 10." Scope is automated scanning + negative-path security tests in CI, not manual penetration testing. Not for: mapping security controls to regulations (SOC 2, HIPAA, PCI, GDPR) — use compliance-testing; pipeline stage wiring and deploy gating mechanics — use ci-cd-integration; purely functional API auth/input tests with no attacker model — see api-testing; testing your product's own LLM features or defending the agent itself (prompt-injection detector, indirect injection, jailbreak red-teaming) — use ai-system-testing. Related: ci-cd-integration, compliance-testing, api-testing, shift-left-testing, ai-system-testing.

日本語の概要は準備中です。原文の説明を表示しています。

Implement authentication with Amazon Cognito. Create user pools for sign-up and sign-in, configure identity pools for AWS access, handle JWT tokens, set up social federation with Google and Facebook, and secure APIs with Cognito authorizers.

日本語の概要は準備中です。原文の説明を表示しています。

Builds full-stack web applications with AdonisJS — a batteries-included Node.js framework with ORM, auth, validation, and mailer built-in. Use when someone asks to "build a web app with Node.js", "Laravel for Node.js", "full-stack Node framework", "AdonisJS", "batteries-included backend", or "Node.js with built-in ORM and auth". Covers Lucid ORM, auth (sessions, tokens, social), VineJS validation, Edge templates, and deployment.

日本語の概要は準備中です。原文の説明を表示しています。

Firebase gives you a complete backend in minutes - auth, database, storage, functions, hosting. But the ease of setup hides real complexity. Security rules are your last line of defense, and they're often wrong. Firestore queries are limited, and you learn this after you've designed your data model. This skill covers Firebase Authentication, Firestore, Realtime Database, Cloud Functions, Cloud Storage, and Firebase Hosting. Key insight: Firebase is optimized for read-heavy, denormalized data. If you're thinking relationally, you're thinking wrong. 2025 lesson: Firestore pricing can surprise you. Reads are cheap until they're not. A poorly designed listener can cost more than a dedicated database. Plan your data model for your query patterns, not your data relationships. Use when "firebase, firestore, firebase auth, cloud functions, firebase storage, realtime database, firebase hosting, firebase emulator, security rules, firebase admin, firebase, firestore, cloud-functions, serverless, backend, realtime, authentication, google-cloud" mentioned.

日本語の概要は準備中です。原文の説明を表示しています。

独立开发者与微型 SaaS — 单人或极小团队 (≤3 人) 构建可持续订阅收入的软件产品商业, 有别于自由职业/咨询、企业级 SaaS 和开源维护: (a) 产品发现与验证 (自己的痒 vs 市场优先 Nugent/Walling; 着陆页冒烟测试; 先接 Stripe 再写代码; JTBD 访谈适配独立开发者场景; Reddit/HN/X/社区痛点挖掘; Mom Test 验证框架; 公开构建作为验证机制); (b) 独立开发者技术架构 (无聊技术论 McKinley; 单体优先; serverless vs VPS 在 ≤$100/月预算下的取舍; Rails/Django/Laravel/Next.js 等框架的出货速度选型; 托管服务优先于自建; Supabase/PlanetScale/Neon 数据库即服务; Clerk/Auth0 认证即服务; Stripe/Paddle/LemonSqueezy 支付; Vercel/Fly.io/Railway 部署; AI 辅助编码 Cursor/Copilot 作为力量倍增器); (c) 无营销团队的分发与增长 (SEO 作为微型 SaaS 护城河; Product Hunt 发布; AppSumo 终身授权利弊; 冷邮件; Twitter/X 公开构建; IndieHackers 社区分发; 集成市场 Shopify/WordPress/Zapier/Slack 应用目录; 联盟计划; 一人内容营销); (d) 定价与变现 (SaaS 定价心理学; freemium vs 免费试用 vs 纯付费; 按席位 vs 按用量 vs 固定费率; 年付折扣; 老用户保价; 微型 SaaS 流失率控制; MRR/ARR/LTV/CAC 在微型规模的含义; $10K MRR 里程碑心理学); (e) 独立创始人心智模型与生活设计 (default alive vs default dead Graham; 拉面盈利 Levels; 生活方式生意 vs 增长生意的光谱; 独立开发者倦怠预防; 时间管理与上下文切换成本; 地理套利与远程优先; 一次构建反复销售的资产思维; 社区作为支持网络 IndieHackers/WIP/MicroConf); (f) 法务与运营基础 (公司注册地选择 LLC/Ltd/GmbH 税效; Stripe Atlas vs Firstbase vs 本地律师; 服务条款与隐私政策; GDPR/CCPA 低成本合规; 知识产权基础; 首次雇人的承包商 vs 员工选择; 独立开发者会计 SaaS — Xero/QuickBooks; 多辖区税务义务)。中国独立开发者生态: 出海作为主导策略 (从中国构建面向全球市场的产品以避开国内竞争/监管); 即刻/V2EX/少数派作为社区枢纽; 微信小程序作为替代分发; 小报童/爱发电作为中文市场变现; 人民币定价心理学; 支付宝/微信支付集成; ICP 备案要求; 中国区 App Store 审核差异; 独立开发者周刊。诚实处理: 生存偏差 (每一个 Pieter Levels 背后是数千个从未达到 $1K MRR 的人), AI 对微型 SaaS 生态位的颠覆 (wrapper 产品脆弱), 独自构建的孤独与心理健康成本, 公开构建的表演性质 vs 真正透明, AppSumo 终身授权上瘾毁坏单位经济, 样板代码销售的伦理边界。不含: 企业级 SaaS (不同 GTM/销售/融资模型), 不含: 自由职业/咨询 (用时间换钱非建资产), 不含: 开源维护 (不同可持续性模型), 不含: 风投支持的创业 (不同增长期望), 不含: 无代码/低代码平台构建 (相邻但不同受众), 不含: 内容创作作为主业。 (Independent Developer and Micro-SaaS — the craft of single-person or tiny-team (≤3 people) software product businesses that generate sustainable recurring revenue without venture capital, distinct from freelancing/consulting, enterprise SaaS, and open-source maintainership: (a) product discovery and validation (scratching your own itch vs market-first Nugent/Walling; landing page smoke tests; Stripe checkout before code; Jobs-to-Be-Done interview adapted to solo context; Reddit/HN/X/community pain-point mining; idea validation frameworks Fitzpatrick Mom Test; build-in-public as validation mechanism); (b) technical architecture for solo operators (boring technology thesis Mckinley; monolith-first; serverless vs VPS tradeoffs for ≤$100/mo infra; framework selection for shipping speed — Rails/Django/Laravel/Next.js/Remix/SvelteKit; managed services over self-hosted whenever possible; database-as-a-service Supabase/PlanetScale/Neon/Turso; auth-as-a-service Clerk/Auth0/Supabase Auth; payment integration Stripe/Paddle/LemonSqueezy; deployment Vercel/Fly.io/Railway/Render; monorepo vs polyrepo for solo; AI-assisted coding Cursor/Copilot as force multiplier); (c) distribution and growth without a marketing team (SEO as moat for micro-SaaS Ahrefs-style content marketing on 1-person budget; Product Hunt launches; AppSumo lifetime deals tradeoffs; cold email outreach; Twitter/X building in public; IndieHackers community distribution; integration marketplaces Shopify/WordPress/Zapier/Slack app directories as channels; affiliate programs; content marketing at scale-of-one); (d) pricing and monetization (SaaS pricing psychology Patel/Campbell; freemium vs free trial vs paid-only; per-seat vs usage-based vs flat-rate; annual discount strategies; grandfathering existing customers; churn reduction for micro-SaaS — Baremetrics/ProfitWell/ChartMogul analytics; MRR/ARR/LTV/CAC at micro scale; the $10K MRR milestone psychology); (e) solo founder mental model and lifestyle design (default alive vs default dead Graham; ramen profitability Levels; lifestyle business vs growth business spectrum; burnout prevention for solo operators — no team to delegate to; time management and context-switching costs; geographic arbitrage and remote-first; the 'build once sell twice' asset mindset; community as support network IndieHackers/WIP/MicroConf); (f) legal and operational basics (incorporation LLC/Ltd/Gm

日本語の概要は準備中です。原文の説明を表示しています。

Clerk authentication router. Use when user asks about Clerk CLI operations, adding authentication, setting up Clerk, custom sign-in flows, Swift or native iOS auth, native Android auth, Next.js patterns, React patterns, Vue patterns, Nuxt patterns, Astro patterns, TanStack Start patterns, Expo patterns, React Router patterns, Chrome Extension patterns, organizations, billing, subscriptions, payments, pricing, plans, seat-based pricing, feature entitlements, syncing users, or testing. Automatically routes to the specific skill based on their task.

日本語の概要は準備中です。原文の説明を表示しています。

Validates and summarizes the four required authorization forms in a personal injury matter (retainer, HIPAA release, insurance authorization, employment record release). Confirms signatures, dates, scope, and completeness to determine readiness for the investigation phase. Use when reviewing client onboarding packets, verifying authorization forms before discovery, or checking HIPAA and record-release compliance.

日本語の概要は準備中です。原文の説明を表示しています。

Implements permission-based authorization with custom attributes, policy providers, and authorization handlers. Provides granular access control beyond simple role-based authorization.

日本語の概要は準備中です。原文の説明を表示しています。

Maintain authenticated local profile APIs, user authentication-flow preferences and UI integration, canonical account selection, atomic identity-bound operations, browser origin checks, and credential-management TLS tests.

日本語の概要は準備中です。原文の説明を表示しています。

Build, customize, or update AuthCrunch authentication portal themes using Go HTML templates, CSS, and SVG branding. Use for responsive layouts, login QR controls, cross-device approval views, filesystem overrides, UI/static-asset configuration, internationalization, and OIDC page styling. The embedded React profile application has a separate build.

日本語の概要は準備中です。原文の説明を表示しています。

Maintain cmd/authdbctl commands, flags, configuration, terminal input, management retries, output, and executable E2E tests. Use authentication-client for the reusable portal login protocol.

日本語の概要は準備中です。原文の説明を表示しています。

Maintain injected credential authenticators, method-isolated caching, request-context propagation, and the pure-Go SQLite API-key plugin. Excludes interactive portal password authentication and identity-store provisioning.

日本語の概要は準備中です。原文の説明を表示しています。

Maintain required external authorization decisions, gatekeeper and validator hooks, the HTTP JSON plugin, reusable parsers, and protected-request E2E coverage. Excludes credential authentication and claims enrichment.

日本語の概要は準備中です。原文の説明を表示しています。

Maintain the standalone cmd/authdb server, pkg/httpserver listener and portal routing, HTTP configuration parser, TLS, shutdown, executable tests, and deployment guidance. Use authdbctl for the management client.

日本語の概要は準備中です。原文の説明を表示しています。

Maintain authorization ACL rules, typed custom claim fields, their reusable parser, policy integration, and signed-token or authenticated-user E2E coverage.

日本語の概要は準備中です。原文の説明を表示しています。

Audit AuthCrunch security boundaries, triage vulnerability reports and scanner findings, reproduce authentication or authorization failures, and prepare evidence-backed remediation. Covers trust, credentials, redirects, concurrency, diagnostic logging, and dependency exposure.

日本語の概要は準備中です。原文の説明を表示しています。

实现认证和鉴权时使用。覆盖 Spring Security / NestJS Guards / Django Auth / FastAPI Depends / Passport / Auth0 集成。融合 OAuth 2.1 + JWT + RBAC + 中间件实现。

日本語の概要は準備中です。原文の説明を表示しています。

Hunt OAuth 2.0 and OIDC flaws — redirect_uri abuse, state CSRF, PKCE bypass, scope manipulation, implicit-flow token theft, postMessage origin tricks, ID token sub claim swap, JWKS confusion, response_type confusion, and OAuth-CSRF. Use when an app has Google/GitHub/Facebook/Apple/custom OAuth or OpenID Connect.

日本語の概要は準備中です。原文の説明を表示しています。

Independent re-derivation gate for proposed changes during autonomous execution. Evaluates a change (code diff, config edit, engine evolution, schema change) against the work's authority matrix and a 4-check protocol: invariant compliance, scope authorization, detection narrowness, and regression risk. Returns structured JSON with pass/fail per check, an overall verdict (APPROVE / REQUEST_CHANGES / REJECT), and blockers. Profile-driven thresholds (strict for unattended runs, lenient for desk supervision). Use when an autonomous agent proposes an engine change, when reviewing a Claude Code-authored modification before merge, or when an unattended profile requires independent re-derivation. Trigger on: "review/approve this proposed change," "critic-gate this," "is this change safe," "is this safe to merge," "should I let this land," "run the critic." Do NOT use for handoff-readiness checks (use rootnode-handoff-trigger-check), general code review, or design-time correctness. Authority matrix required.

日本語の概要は準備中です。原文の説明を表示しています。

FastAPI web framework conventions: APIRouter with prefix/tags/dependencies, Pydantic v2 schemas (BaseModel, model_config, field_validator, model_validator), dependency injection with Depends, async SQLAlchemy session yielding, OAuth2PasswordBearer + JWT auth, lifespan context manager, pydantic-settings configuration, OpenAPI customization, and HTTPException error handling. Activated automatically by fastapi-plugin/stack.md. Use this skill to: - Structure FastAPI apps with per-feature APIRouter modules and a central app factory. - Write Pydantic v2 request and response schemas with proper validators. - Build a reusable Depends-based dependency chain for DB session, auth, and pagination. - Implement JWT-based authentication with get_current_user dependency. - Configure the app from environment variables via pydantic-settings. Do NOT use this skill for: - SQLAlchemy ORM model configuration and Alembic migrations — see fastapi-plugin:sqlalchemy-patterns. - Python language idioms — see python-foundation:python-conventions. - Testing patterns — see python-foundation:pytest-testing.

日本語の概要は準備中です。原文の説明を表示しています。

Flask web framework conventions: app factory pattern with create_app(), Blueprint registration with url_prefix, MethodView for class-based API views, Marshmallow schema validation, WTForms for HTML forms, Flask-Login for session auth, flask-jwt-extended for stateless API auth, Jinja2 template conventions, error handlers, and extension initialization. Activated automatically by flask-plugin/stack.md. Use this skill to: - Structure Flask applications with the app factory and per-feature Blueprints. - Validate JSON request data with Marshmallow and HTML forms with WTForms. - Implement session-based auth with Flask-Login or token auth with flask-jwt-extended. - Render Jinja2 templates safely or return JSON responses for API mode. - Register global error handlers for consistent error responses. Do NOT use this skill for: - SQLAlchemy ORM model patterns and Flask-Migrate — see flask-plugin:sqlalchemy-patterns. - Python language idioms — see python-foundation:python-conventions. - Testing patterns — see python-foundation:pytest-testing.

日本語の概要は準備中です。原文の説明を表示しています。

Security-focused development skill covering OWASP Top 10 and secure coding. Use when implementing authentication, handling user data, or security review. Keywords: security, auth, authentication, authorization, OWASP, XSS, SQL injection, CSRF, secure

日本語の概要は準備中です。原文の説明を表示しています。

Identify and exploit logical flaws in OAuth 2.0 and OpenID Connect workflows. Use this skill when testing "Sign in with Google/Facebook/Apple" features, focusing on Authorization Code interception, Implicit flow token leakage, standard CSRF bypassing via missing `state` parameters, and redirect logic flaws.

日本語の概要は準備中です。原文の説明を表示しています。

Identify and exploit logic flaws in OAuth implementations, focusing specifically on the absence or improper validation of the `state` parameter, which leads to Cross-Site Request Forgery (CSRF) and account takeover (ATO).

日本語の概要は準備中です。原文の説明を表示しています。