emre-guler

emre-guler/websec

Plugin Claude Code

Security review skills for Claude Code.

emre-guler/websec

Plugin Claude Code

Web application security review skills: architecture recon, 33 vulnerability-class detectors, and a consolidated severity-ranked report.

emre-guler/websec

Agent

Locates candidate sites for one vulnerability class across a codebase and records them for later verification. Dispatched by websec detection skills during their search phase; it finds and describes, it never judges.

emre-guler/websec

Agent

Traces a small set of candidate sites end to end and classifies each against a vulnerability class with evidence. Dispatched by websec detection skills during their verification phase; it decides, and it must show why.

emre-guler/websec

Skill Claude CodeCodex

Use when reviewing a web application for authorization flaws — object IDs or filenames taken from requests, admin or staff routes, role or permission checks, multi-step flows, tenant boundaries — or when asked to find IDOR, privilege escalation, broken access control, or "can user A reach user B's data" issues.

emre-guler/websec

Skill Claude CodeCodex

Use when starting a security review of a web application codebase, when a detection skill reports that architecture.md is missing, or when the codebase has changed enough that the existing architecture summary is stale.

emre-guler/websec

Skill Claude CodeCodex

Use when reviewing a REST or JSON API for surface the front end never exercises — undocumented or legacy endpoints, multiple live versions, catch-all or method-agnostic routes, request bodies bound wholesale onto models or entities, protected properties such as isAdmin or balance reachable through an update, or user…

emre-guler/websec

Skill Claude CodeCodex

Use when reviewing login, registration, logout, password reset or change, remember-me tokens, multi-factor challenges, or session and cookie configuration — or when asked about brute force, account lockout, credential stuffing, username enumeration, 2FA bypass, weak password hashing, forgeable session tokens, or…

emre-guler/websec

Skill Claude CodeCodex

Use when reviewing an application whose rules involve money, quantity, discounts, coupons, limits, quotas, refunds, credits, loyalty points, entitlements, or multi-step flows — or when prices, totals, or eligibility arrive from the client, when one endpoint changes behaviour depending on which parameters are present…

emre-guler/websec

Skill Claude CodeCodex

Use when sensitive pages may be loaded in a frame by another site — no X-Frame-Options, no CSP frame-ancestors, frameguard disabled, @xframeoptionsexempt, frameOptions().disable(), headers set on only some routes — or when one-click state changes, forms prefilled from query parameters, or client-side frame-busting…

emre-guler/websec

Skill Claude CodeCodex

Use when a server sets Access-Control-Allow-Origin from the request Origin, pairs it with Access-Control-Allow-Credentials: true, matches allowed origins with startsWith/endsWith/includes or loose regex, trusts the null origin or an http:// origin, or wildcards authenticated or internal endpoints; also when asked to…

emre-guler/websec

Skill Claude CodeCodex

Use when a codebase hashes passwords, encrypts or decrypts stored data, generates tokens, salts, nonces or session identifiers, compares a signature or a MAC, derives a key from a passphrase, or sets certificate options on an HTTP client — or when asked about weak or missing encryption, ECB mode, reused IVs, insecure…

emre-guler/websec

Skill Claude CodeCodex

Use when state-changing endpoints authenticate with session cookies — email or password change, role updates, transfers, deletions — or when anti-forgery middleware is disabled, exempted or unevenly mounted, tokens are compared against a cookie, Referer checks or method-override parameters appear, or cookies are set…

emre-guler/websec

Skill Claude CodeCodex

Use when the application rebuilds objects from bytes it received — serialized session cookies, hidden form state, cached or queued payloads, uploaded files, binary or type-carrying blobs — or when reviewing native object readers and polymorphic type handling, and when asked to find insecure deserialization, object…

emre-guler/websec

Skill Claude CodeCodex

Use when client-side JavaScript passes URL, document.referrer, window.name, cookie, storage or postMessage data into navigation, cookie, storage, request, socket, parser or DOM-property APIs — location.href, window.open, document.cookie, setRequestHeader, new WebSocket, JSON.parse, document.evaluate, executeSql — or…

emre-guler/websec

Skill Claude CodeCodex

Use when the application accepts files from users — multipart handlers, avatar or attachment endpoints, document and media import, "fetch from URL" imports, archive imports — or when reviewing where uploaded files are stored and served, and when asked to find unrestricted file upload, web shell upload, extension…

emre-guler/websec

Skill Claude CodeCodex

Use when a codebase serves a GraphQL endpoint — schema or SDL files, resolver maps, code-first type definitions, Apollo or similar server setup, a playground, or subscriptions — and especially when introspection or suggestions may be enabled in production, resolvers fetch objects straight from a client-supplied…

emre-guler/websec

Skill Claude CodeCodex

Use when application code builds absolute URLs, password-reset or invitation links, redirects, or email content from the request's host, when forwarded-host or forwarded-scheme headers are honoured, when a proxy routes or names a backend from the client-supplied host, or when asked about reset-link poisoning…

emre-guler/websec

Skill Claude CodeCodex

Use when reviewing error handling, debug or diagnostic endpoints, framework debug flags, server banners, directory listing, what a build copies into a served directory, developer comments or credentials in shipped client code, or responses that differ by internal state — or when asked about leaked stack traces…

emre-guler/websec

Skill Claude CodeCodex

Use when a codebase issues or accepts JSON Web Tokens — bearer credentials, session cookies holding a signed token, identity tokens from a login provider, key-set endpoints, or kid, jwk and jku header handling — or when asked about token forgery, algorithm confusion, alg none, weak signing secrets, or missing claim…

emre-guler/websec

Skill Claude CodeCodex

Use when an application embeds a language model — chat endpoints, model SDK calls, prompt templates, retrieval or document context, agent loops — and especially when untrusted text is concatenated into a prompt, when tools or functions exposed to the model perform real actions or run with service credentials, or when…

emre-guler/websec

Skill Claude CodeCodex

Use when reviewing an application backed by a document or key-value store — MongoDB, Mongoose, Couchbase, DynamoDB, Cassandra, Neo4j — where request JSON or query strings become query filters, where a login compares username and password in a single lookup, or where server-side JavaScript expressions are evaluated, or…

emre-guler/websec

Skill Claude CodeCodex

Use when reviewing social or delegated sign-in, an authorization callback handler, state or nonce handling, redirecturi matching, authorization-code exchange, idtoken consumption, scope enforcement, PKCE, dynamic client registration, or an identity provider — or when asked about account takeover through a third-party…

emre-guler/websec

Skill Claude CodeCodex

Use when reviewing a web application for redirects whose destination comes from the request — next, returnUrl, redirect, url, continue, dest parameters, post-login or post-action return targets, Location headers and framework redirect calls built from user input, allowlists compared with prefix, substring or suffix…