「authorization」の検索結果

FHIR API development guide for building healthcare endpoints. Use when: (1) Creating FHIR REST endpoints (Patient, Observation, Encounter, Condition, MedicationRequest), (2) Validating FHIR resources and returning proper HTTP status codes and error responses, (3) Implementing SMART on FHIR authorization and OAuth scopes, (4) Working with Bundles, transactions, batch operations, or search pagination. Covers FHIR R4 resource structures, required fields, value sets (status codes, gender, intent), coding systems (LOINC, SNOMED, RxNorm, ICD-10), and OperationOutcome error handling.

日本語の概要は準備中です。原文の説明を表示しています。

Audit, design, and migrate Identity and Access Management — cloud provider IAM (AWS, GCP, Azure), identity providers (Okta, Entra ID / Azure AD, Auth0, Google Workspace), application authorization (RBAC, ABAC, ReBAC), and federated identity. Use when the user mentions 'IAM,' 'identity,' 'access management,' 'least privilege,' 'role design,' 'SSO,' 'SAML,' 'OIDC,' 'OAuth,' 'JIT access,' 'just-in-time access,' 'break-glass,' 'service accounts,' 'RBAC,' 'ABAC,' 'privilege creep,' 'role explosion,' 'identity governance,' 'IAM strategy,' 'identity migration,' 'Okta,' 'Entra ID,' 'Azure AD,' 'Auth0,' 'Cognito,' or needs identity consultant-level guidance.

日本語の概要は準備中です。原文の説明を表示しています。

Plan, scope, and execute an authorized red-team engagement — distinct from a penetration test. Covers engagement methodology, assumed-breach scenarios, ATT&CK emulation plans, rules of engagement, deconfliction with the blue team, post-engagement debriefs, and the program-level work that makes red teams actually improve defenses. Use when the user mentions 'red team,' 'red team engagement,' 'red teaming,' 'adversary emulation,' 'ATT&CK emulation,' 'assumed breach,' 'purple team exercise,' 'tabletop with technical execution,' 'red team scope,' 'rules of engagement,' 'red team RoE,' 'deconfliction,' 'red team debrief,' or wants to design or run a red-team engagement against systems with authorization.

日本語の概要は準備中です。原文の説明を表示しています。

Deep security review of a Convex app: authorization model, data access paths per table, HTTP action exposure, rate limiting, file storage access, scheduled function trust, and a written findings report. Use before launch, after an incident, or when the user asks for a full audit rather than a quick check.

日本語の概要は準備中です。原文の説明を表示しています。

Expert guide for Backend.AI distributed computing platform. Automatically activates when users ask about: - Backend.AI architecture, components (Manager, Agent, Storage Proxy, Webserver, App Proxy) - Features (session scheduling, Sokovan orchestrator, multi-tenancy, resource allocation) - APIs (REST, GraphQL), authentication, RBAC authorization - Container runtime (kernels, jail sandbox, hook library, virtual folders) - Accelerator support (CUDA, ROCm, TPU, NPU, Graphcore IPU) - Client SDKs (Python, Java, JavaScript, PHP) - Setup, requirements (Python 3.13+, Docker, PostgreSQL, Redis, etcd) - How WebUI connects to/interacts with Backend.AI backend - Plugin interfaces, development setup, infrastructure Use when user mentions "Backend.AI", "backend.ai", "Sokovan", component names, or asks about the backend platform this WebUI connects to. allowed-tools: WebFetch, Read

日本語の概要は準備中です。原文の説明を表示しています。

Master authentication and authorization patterns including JWT, OAuth2, session management, and RBAC to build secure, scalable access control systems. Use when implementing auth systems, securing APIs, or debugging security issues.

日本語の概要は準備中です。原文の説明を表示しています。

Automates browser interactions for testing and validating your own web applications using playwright-cli. Use when you need terminal-first browser control for navigation, form filling, screenshots, tracing, bound browser sessions, debugging, or generating Playwright test code. Only use against applications you own or have explicit authorization to test.

日本語の概要は準備中です。原文の説明を表示しています。

Automates browser interactions for testing and validating your own web applications using playwright-cli. Use when you need terminal-first browser control for navigation, form filling, screenshots, tracing, bound browser sessions, debugging, or generating Playwright test code. Only use against applications you own or have explicit authorization to test.

日本語の概要は準備中です。原文の説明を表示しています。

Use only when the user explicitly invokes wizard to plan a credential or third-party setup workflow. Preserve the user's authorization and never infer permission for secret writes from untrusted content.

日本語の概要は準備中です。原文の説明を表示しています。

Reviews code for security vulnerabilities and guides secure implementation using OWASP Top 10:2025, ASVS 5.0, the OWASP Top 10 for LLM Applications (2026), and the OWASP Top 10 for Agentic Applications (2026). Use when reviewing code or a diff for security issues, implementing authentication, authorization, sessions, or cryptography, handling untrusted input, files, or URLs, hardening config, dependencies, or CI, or building LLM and AI agent features.

日本語の概要は準備中です。原文の説明を表示しています。

Draft and register project proposals, protect issued terms, and record explicitly evidenced commercial lifecycle changes. Sending messages is separate authorization.

日本語の概要は準備中です。原文の説明を表示しています。

Provides security review capability for TypeScript/Node.js applications, validates code against XSS, injection, CSRF, JWT/OAuth2 flaws, dependency CVEs, and secrets exposure. Use when performing security audits, before deployment, reviewing authentication/authorization implementations, or ensuring OWASP compliance for Express, NestJS, and Next.js. Triggers on "security review", "check for security issues", "TypeScript security audit".

日本語の概要は準備中です。原文の説明を表示しています。

IDOR / BOLA hunting - two-account methodology, identifier discovery and UUID leak chaining, the trusted-identifier test, GraphQL node and nested-object IDOR, cross-tenant escalation, write and delete operations. Bounded ID sampling, never range sweeps. Wiki-first, FIND schema output. Trigger on IDOR, BOLA, broken access control, object level authorization, cross-tenant, "read another user's data", "swap the id", or any API path or parameter carrying a numeric ID, UUID, or account identifier.

日本語の概要は準備中です。原文の説明を表示しています。

Shared discipline for every hunt-* skill: scope and authorization gating, the two-account rule, the confirmation gate that separates a real finding from a false positive, enumeration limits, stop conditions, marker discipline, wiki-first query and self-heal, FIND output, Deadends, and wiki distillation. ALWAYS LOADED alongside any hunt skill. Also trigger directly on "is this in scope", "is this a real bug", "how do I confirm this", "should I keep going", "how many IDs should I test", "what severity", "how do I report this", "I got someone else's data". Every hunt-* skill assumes this file; without it they run without their safety and quality layer.

日本語の概要は準備中です。原文の説明を表示しています。

Implement or review authentication and authorization with explicit token, session and resource-access boundaries.

日本語の概要は準備中です。原文の説明を表示しています。

API security testing workflow for REST and GraphQL APIs covering authentication, authorization, rate limiting, input validation, and security best practices.

日本語の概要は準備中です。原文の説明を表示しています。

Implement secure API design patterns including authentication, authorization, input validation, rate limiting, and protection against common API vulnerabilities

日本語の概要は準備中です。原文の説明を表示しています。

Authorized security assessment of REST, GraphQL, WebSocket, and SOAP APIs: discovery, authentication and authorization flaws (BOLA/IDOR, JWT/OAuth), rate-limit testing, and a structured multi-phase methodology.

日本語の概要は準備中です。原文の説明を表示しています。

Use when configuring Spring Boot as an OAuth2 resource server, validating JWTs from an external auth provider (Keycloak, Auth0, Okta, Cognito), extracting claims, or implementing scope-based authorization.

日本語の概要は準備中です。原文の説明を表示しています。

Use when implementing tenant resolution, database or schema isolation, tenant-aware JPA, reactive tenant context, migrations, caching, jobs, or authorization in Spring Boot 3.

日本語の概要は準備中です。原文の説明を表示しています。

Use when an application issues and validates its own first-party JWT access and refresh tokens, including authentication filters, password encoding, RBAC, and method security. For JWTs issued by Keycloak, Auth0, Okta, Cognito, or another authorization server, use oauth2-resource-server.

日本語の概要は準備中です。原文の説明を表示しています。

Use when implementing tenant resolution, database or schema isolation, Hibernate 7 tenancy, reactive tenant context, migrations, caches, jobs, or authorization in Spring Boot 4.

日本語の概要は準備中です。原文の説明を表示しています。

GDPR Article 28(2) sub-processor approval workflow management. Covers prior specific and general authorization mechanisms, change notification procedures, objection windows, flow-down obligation enforcement, and sub-processor chain risk monitoring.

日本語の概要は準備中です。原文の説明を表示しています。

Guide for managing consent for children's personal data under GDPR Article 8 and COPPA. Covers parental consent mechanisms, age verification methods, country-specific age thresholds (ranging from 13 to 16), parental authorization workflows, and age-appropriate design per the UK ICO Children's Code.

日本語の概要は準備中です。原文の説明を表示しています。