A skill based on "rfdslabs" prompt to have a good hunting session.
This repository also configures its own agents. See what vuln-skill-pack tells them →
Cursor rule Cursor
Next.js & Vercel security footguns — client/server secret leakage via NEXTPUBLIC, unauthenticated Server Actions and Route Handlers, middleware auth bypass, SSRF in server fetches. Apply when reviewing, building, or shipping a Next.js or Vercel app.
Cursor rule Cursor
Node.js & Express API security footguns — missing auth/authz middleware, IDOR, broken JWT verification, permissive CORS, SQL/NoSQL/command injection, missing rate limiting, mass assignment. Apply when reviewing, building, or shipping a Node/Express (or Fastify/Koa/Nest) backend.
Cursor rule Cursor
Core operating rules for defensive security review with the vun-skill-pack. Always in effect during any security analysis.
Cursor rule Cursor
Stripe security footguns — unverified webhook signatures, trusting price/amount from the client, secret key exposure, missing idempotency, fulfilling on the wrong event. Apply when reviewing, building, or shipping payment or billing flows with Stripe.
Cursor rule Cursor
Supabase security footguns — Row Level Security disabled or too permissive, servicerole key exposed to the client, weak policies, public storage buckets, client-set privilege columns. Apply when the app uses Supabase (Postgres, Auth, Storage, Edge Functions).
At most 3 mods per repository are shown here, and a mod shipped inside a plugin is left to that plugin's page — the rest are on their repository pages: