Claude Skills by Intense-Visions

> Run components on the server to eliminate client JavaScript and enable direct data access

> Pre-render React components on the server for improved SEO and initial load performance

> Choose the right state management approach for your React application scale

> Bundle all dependencies at build time for predictable loading performance

> Declaratively handle async loading states with React Suspense boundaries

> Normalize entity collections with createEntityAdapter for O(1) lookups and pre-built CRUD reducers

> React to dispatched actions and state changes with createListenerMiddleware for structured side effects

> Persist and rehydrate Redux state across browser sessions with redux-persist or manual localStorage strategies

> Apply optimistic and pessimistic cache updates with onQueryStarted for instant UI feedback with automatic rollback

> Define query and mutation endpoints with cache tag invalidation, response transformation, and auto-generated hooks

> Configure RTK Query with createApi and fetchBaseQuery for automatic caching, deduplication, and loading state management

> Derive and memoize computed state with createSelector to avoid redundant calculations and unnecessary re-renders

> Organize Redux state into self-contained slices using createSlice for co-located reducers, actions, and selectors

> Configure the Redux store with configureStore, typed hooks, middleware, and Provider wiring

> Test Redux slices, thunks, selectors, and connected components with focused, maintainable test strategies

> Handle async operations with createAsyncThunk for structured pending/fulfilled/rejected lifecycle management

> Type Redux state, actions, thunks, and hooks with full inference and minimal manual annotation

> Isolate failures by partitioning resources so one failing component cannot exhaust capacity for others

> Validate resilience by injecting controlled failures to verify that fallbacks, retries, and circuit breakers work under real conditions

> Protect services from cascading failures by stopping requests to unhealthy dependencies until they recover

> Handle permanently failing messages with dead letter queues for safe inspection, alerting, and reprocessing

> Provide degraded but functional responses when primary operations fail, ensuring users always get a result

> Implement health check endpoints for service readiness, liveness, and dependency monitoring

> Ensure safe retries by making operations produce the same result regardless of how many times they execute

> Control request throughput with token bucket, sliding window, and fixed window algorithms to protect services from overload

> Handle transient failures with configurable retry strategies, exponential backoff, and jitter

> Prevent resource exhaustion and hung requests with timeouts, AbortController, and deadline propagation

> Evaluate access decisions using attributes of the subject, resource, action, and environment -- eliminating role explosion by expressing authorization as policy rules over contextual data

> Public-key cryptography for key exchange, digital signatures, and identity verification > -- Ed25519 for signatures, X25519 for key exchange, RSA-2048+ only for legacy > compatibility

> Model multi-step adversary strategies as goal-oriented tree decompositions -- revealing which attack paths are cheapest and which defenses yield the highest leverage

> Log the who, what, when, where, and outcome of every security-relevant event in a > structured, tamper-evident format that enables both real-time detection and forensic > reconstruction

> Login, registration, password reset, magic links, and SSO -- each flow has distinct attack surfaces and each must be hardened independently

> Replace ambient authority ("who are you?") with explicit capabilities ("what token do you hold?") -- eliminating confused deputy attacks by making every permission a transferable, revocable, unforgeable object

> X.509 certificates are the backbone of internet trust -- manage them correctly or accept > that attackers can impersonate any service, intercept any connection, and forge any > identity

> Run SAST, DAST, SCA, and secrets scanning on every commit -- automated security gates that > catch vulnerabilities before they reach production

> Sign every artifact you produce and verify every artifact you consume -- because an unsigned > binary could have been built by anyone, including an attacker

> Regulatory frameworks mandate specific logging requirements -- SOC2, GDPR, HIPAA, and > PCI-DSS each define what must be logged, how long logs are retained, and what constitutes > auditable evidence, and failing to meet these requirements carries fines, legal liability, > and loss of certification

> LLM-judgment critique of security posture for TS/JS source — the ceiling counterpart to `harness-security-scan` (CVE/OWASP rule-based floor) and `harness-security-reviewer` (procedural review). Threat-modeling-as-skill rather than pattern-matching. Critiques whether trust boundaries are respected, where implicit privilege escalation lurks, whether the code defends in depth or just at the gate, whether principle of least authority is honored. Sixth non-design member of the craft-pipeline ini...

> Argon2id for new systems, bcrypt for broad compatibility -- always salt, consider peppering, tune cost parameters to hardware, and plan hash upgrade paths

> Every session token, encryption key, nonce, and CSRF token depends on unpredictable randomness -- use a CSPRNG or accept that attackers will predict your secrets

> Your application is 90% third-party code -- scan it for known vulnerabilities, lock it > to exact versions, and have a strategy for when a critical CVE drops on a Friday > afternoon

> Deserialization reconstructs objects from byte streams -- and in most languages, that > reconstruction executes code, meaning an attacker who controls the serialized input controls > what code runs on your server

> Environment variables are visible in process listings, inherited by child processes, > captured in crash dumps, and logged by every debugging tool -- they are the worst place > to store secrets

> Digital forensics is the discipline of collecting, preserving, and analyzing evidence from > compromised systems -- done correctly, it reveals the full attack narrative; done poorly, it > destroys the evidence needed to understand what happened and prevent recurrence

> One-way functions for integrity verification, content addressing, and commitment schemes > -- SHA-256 for interoperability, BLAKE3 for performance, and never MD5 or SHA-1 for > security

> HMAC proves a message was created by someone with the shared secret; digital signatures prove it was created by a specific private key holder -- choose based on whether you need symmetric verification or non-repudiation

> Tell the browser "never connect to this domain over HTTP, ever" -- and make it permanent > by embedding the directive in every browser's shipped preload list

> Authentication at login is necessary but insufficient -- continuously evaluate identity > confidence using device trust, behavioral signals, and environmental context throughout > the session

> The first 60 minutes of a security incident determine whether the organization loses days > of data or months of data -- containment is not about fixing the vulnerability, it is about > stopping the bleeding while preserving the evidence needed to understand what happened

> Every injection vulnerability has the same root cause: untrusted data is interpreted as > code because the boundary between data and instructions was not enforced -- fix the > boundary, fix the bug