Claude Skills by Giovannyengamba

Use when building or reviewing a back-office / admin portal — CRUD routes under /api/admin, role and capability gating, audit logging, deciding what should be editable, bootstrapping the first superadmin, or filling an admin dashboard with data. Covers logAdminAction as a mandatory path, capability-based UI, why API keys must never be editable from an interface, and never inventing a number to fill a chart.

Use when laying out a new codebase, deciding where server-only code lives, debugging a page that works in dev but 500s in production, setting up logging and request IDs, adding an optional third-party provider, validating environment variables, or deciding whether to add multi-tenancy. Covers the server-only boundary, runtime='nodejs' enforcement, AsyncLocalStorage request context, the "missing key = inert, never fatal" convention, and tripwire tests.

Use before shipping to production, or when asked to audit, review or harden the security of an app — including a vibe-coded or AI-generated one, with or without access to the source. Runs 20 controls, ranks findings by real impact, and refuses to mark anything green without evidence. Also covers what to do when a key has been exposed (revoke first, investigate second).

Use when choosing or connecting a third-party service — hosting, database, Redis, email, file storage, error tracking, analytics, real-time, video conferencing, payments — or when setting up Google properties (Cloud Console OAuth credentials, Search Console, Merchant Center, Tag Manager, Analytics, Ads), DNS and email authentication. Also use when asked "what should I use for X", when something works locally but not on serverless, or when planning the order in which to open accounts.

Use when touching money — adding a payment provider (Stripe, PayPal, Notch Pay, Moneroo, Bictorys, PayTech, mobile money), handling a payment webhook, computing or converting an amount, displaying a price in a visitor's currency, implementing withdrawals or balances, or debugging an order stuck in PENDING. Covers raw-body HMAC ordering, idempotency by DB constraint, the transactional outbox, reconciliation when a webhook never arrives, advisory-lock withdrawals, minor units, and display-curre...

Use when a site or page is slow, when nothing is being cached, when adding ISR or cache tags, when a stale value keeps being served, when choosing a deployment region, or when writing background/scheduled work. Covers the dynamic-root-layout trap that makes an entire app uncacheable, cache tags plus TTL invalidation, splitting cached display reads from to-the-second reads, region placement, and why setInterval does not work on serverless.

Use when writing or reviewing anything touching authentication, sessions, cookies, CSRF, rate limiting, roles and permissions, security headers or CSP, file uploads, or the browser HTTP client. Also use when asked to "secure", "harden" or review an endpoint. Covers enumeration-resistant signup, double-submit CSRF and its one documented exception, two-tier rate limiting, role precedence, origin-list CSP (and why not a nonce), magic-byte upload validation.

Use when starting a new web project, or when making a structural decision on an existing one — folder layout, where server code lives, which provider to add, what to check before shipping. This is the router for the Otopcy SoftStart playbook; it carries the ten non-negotiable rules and points to the specialised skills (otopcy-architecture, otopcy-securite, otopcy-paiements, otopcy-performance, otopcy-admin, otopcy-outils, otopcy-audit). Reference stack is Next.js App Router + Prisma + Postgre...