Files

T

shancheas ff6814d038 feat: add new skills for coding standards, continuous learning, detail layout, form layout, project guidelines, security review, and verification loop

- Introduced coding standards for TypeScript and React in SKILL.md.
- Added continuous learning skill with configuration and evaluation scripts.
- Created detail layout guidelines for read-only pages.
- Established form layout rules for data-entry forms.
- Documented project guidelines for the frontend monorepo.
- Implemented security review checklist for frontend/Electron applications.
- Developed a verification loop skill for comprehensive session checks.

This commit enhances the skill set available for developers, ensuring adherence to best practices and improving code quality.

2026-08-25 16:58:10 +07:00

2.4 KiB

Raw Blame History

name, description

name	description
security-review	Use this skill when adding authentication, handling user input, working with secrets, or touching Electron IPC. Frontend/Electron security checklist for this SPA monorepo.

Security Review Skill

Client-side security for this React/Electron frontend. There is no NestJS API or SQL layer in this repo.

When to Activate

Auth or session handling
Forms and user input
Secrets / env vars
Electron preload / IPC
Rendering HTML from the server or users

Checklist

1. Secrets

// NEVER
const apiKey = "sk-proj-xxxxx"

// ALWAYS
import { ENV } from '../environment'
if (!ENV.API_BASE_URL) throw new Error('VITE_API_BASE_URL is not configured')

No hardcoded secrets
Env files only under apps/*/.env* (apps/web/.env.example)
Components use ENV, not scattered import.meta.env
Treat all VITE_* as public

2. Input validation

Zod + @repo/ui/validators (compose, required, rangeLength) on every form. File uploads: size, MIME, extension allow-lists.

3. XSS

React text nodes by default
No unsanitized dangerouslySetInnerHTML
Sanitize if HTML is required (DOMPurify)

4. Auth

HTTP only through apiClient (src/core/lib/api-client)
Session teardown via terminateAuthSession
Do not log tokens
Redirect query params encoded

Do not invent httpOnly-cookie APIs this SPA does not own. Token storage follows the existing auth.helper + storage adapters.

5. Electron (`apps/desktop`)

contextIsolation: true
nodeIntegration: false
sandbox: true
No new Node APIs on window outside preload

6. Sensitive data

No tokens or passwords in logs
Generic user-facing errors; details in telemetry only

7. Dependencies

pnpm audit

Lockfile committed
No known high/critical issues without a documented exception

Out of scope (backend)

Do not spend review time on SQL injection, Drizzle, CSRF-on-API-routes, or API rate limits. Flag them only if this client is clearly bypassing the API contract.

Resources

Remember: One XSS or leaked VITE_ secret in the client is enough. Prefer the existing apiClient and ENV wrappers.

2.4 KiB Raw Blame History