Claude Skills by ReazGan

Check what an app exposes on its own running URL: secrets in the JavaScript bundle, a reachable .env or .git, source maps, missing security headers, weak cookie flags, permissive CORS, an unverified Stripe webhook, an unthrottled endpoint, and Supabase or Firebase data an anon key can read. Use when the user gives their own localhost, staging or live URL and asks if it leaks or is safe to launch.

Audit an app for security holes before it ships, then fix them and prove the fix. Use when the user asks if the app is safe or ready to launch, wants a security review or pre-deploy check, pasted or exported an app from Lovable, Bolt, v0, Cursor or Claude Code, or asks to harden Supabase, Firebase, Stripe, auth, uploads, dependencies or API keys. Reads the whole project, no git history needed.

Write authentication, database access, secret handling, payments, file uploads, and LLM endpoints securely by default. Use whenever adding or editing login or sessions, Supabase or Firebase queries, API routes or Server Actions, environment variables or API keys, Stripe or checkout code, upload handlers, CORS, redirects, or a route that calls an LLM, even when the user does not mention security.