Database schema rules for QAuth. Use when working with the identity model, Drizzle ORM, migrations, repositories, or claim resolution. Reflects the CURRENT shipped schema — the identifier-abstraction model (ADR-002, IMPLEMENTED via Epic.
Implements and reviews security controls for auth-server and OAuth flows following OWASP API Security Top 10, dependency hygiene (CVE/audit), and timing-safe practices. Use when hardening authentication, rate limiting, secrets handling, or when the user asks about security, CVEs, or OWASP.
Input validation and Zod v4 schemas for QAuth — standalone format validators (z.email/z.uuid/z.url, not the deprecated string-method form), schema organization, length limits, and normalize-before-validate. Use when adding or reviewing Zod schemas, route validation, or config validation.
Instructions for qauth-labs/qauth, covering general guidelines for working with nx, scaffolding & generators, when to use nxdocs, qauth project guide and architecture principles.
Instructions for qauth-labs/qauth, a project described as: Post-quantum ready, headless-first identity platform. A developer-friendly alternative to Keycloak.