A lightweight, defense-focused audit of your own/authorized website or web app, driven by the OWASP Top 10. Non-destructively checks security headers, cookie attributes, XSS/SQLi exposure, dependency CVEs, and WordPress/Next.js-specific points. Each finding comes with a severity and an immediately actionable fix (config and code examples), output as a concise report. For full engagements (RoE, formal report), use the Pentest Engagement Kit. Authorized assets only.
Defensive application-security auditing: turns a repo, manifest, or code snippet into an actionable report—dependency vulnerabilities, leaked secrets, insecure code patterns, and config hardening—mapped to OWASP Top 10 and ranked by severity. Finds risk and the fix only, never attack content.
Audits local static HTML/CSS against 11 selected WCAG 2.1 AA checks, optionally applies conservative local HTML fixes with .bak backups, and exports JSON/HTML reports. No SSH, remote deployment, or compliance certification.
This is the scoring reference the agent uses to turn raw crawl/API data into prioritized findings. Keep this file as the single source of truth — update it whenever a real audit reveals a false positive or a missing check. Scope covered: Crawlability & Indexation, Performance (Core Web Vitals), Structure & Markup. (Mobile/Architecture can be added in a later version.)
Over 5,000 ADA accessibility lawsuits were filed in the US last year. 64% targeted businesses under $25M revenue. Most started with an automated scan — the same kind this agent runs on your site. Enter a URL. Get a risk report: which WCAG 2.2 AA failures a plaintiff's scanner would flag, ranked by lawsuit likelihood, with the exact fix for each. Covers contrast, alt text, labels, ARIA, focus order, and touch targets. Not a compliance certificate. A radar for what's coming.
Four independent AI reviewers — Security Skeptic, Reliability Realist, Maintainability Pragmatist, and Performance Pessimist — each review your diff blind to the others' verdicts, so real bugs don't get averaged away into one polite summary.
I have spent more than 25 years in programming and web development, with a strong focus on performance, security, and writing lean code that does not waste resources. Good code should be clear, fast, safe, and practical to maintain. That same mindset is what I bring to this skill.
Supabase RLS Security Auditor assesses and audits Supabase apps across RLS, Auth/IAM, data security, APIs, Edge Functions, storage, secrets, third-party integrations, governance, logging, and security operations. Built for founders, vibe-coded apps, SaaS teams, and builders preparing to launch. Returns prioritized findings, exploit paths, safe SQL/architecture fixes, regression tests, and launch-blocker guidance.
I've reviewed hundreds of codebases and PRs across Python, JavaScript, C#, TypeScript, Go, Rust, and more. I've distilled that debugging and code review judgment into this skill to help you find bugs, spot security vulnerabilities, and improve code quality before merging.