All categories
Security
Security audits, vulnerabilities, compliance, auth, secrets, and safe automation
- 29,704
- 1,238
Security grades appear on each card once the skill has been scanned. Newly imported skills may briefly show without a grade until the backfill job runs.
Open in full browserBrowse security skills
Showing 3,817–3,840 of 29,704 skills
- AuthHow to use @owlmeans/auth — the core authentication and authorization vocabulary shared by server and client, covering the Auth / AuthPayload / AuthCredentials types, the AuthRole and AuthenticationType enums, the error hierarchy (AuthUnknown, AuthenFailed, AuthForbidden …), the request JSON schemas, the entrypoint aliases, and authHelper.entitySlugOf for reading the organization entity off a token. Auto-invoked when importing auth types, errors, schemas or constants, or when working with req...Votes: 0GitHub stars: 3
- Auth ProtocolComprehensive reference for the OwlMeans authentication and authorization protocol — the Ed25519, OIDC, provider-backed local identity, email-OTP, hosted-app (integrated provider) and PK-supervisor paths, the identity model (one account per e-mail, credentials on the account, profile rows per app and organization, organizations with groups), pairwise subjects, the acting organization as session state and its switch, the four permission kinds, the core types and error hierarchy, guards and gat...Votes: 0GitHub stars: 3
- Auth TokenHow to use @owlmeans/auth-token — the contracts behind long-lived access tokens (API keys) — the token format and its deployment prefix, the three management routes, the Authorization parsing that Bearer needs, and the client-side carrier guard a CLI or an MCP server authenticates with. Auto-invoked when importing the token entrypoints, the carrier guard, parseAuthorizationHeader, or an access-token type.Votes: 0GitHub stars: 3
- Api Config ServerHow to use @owlmeans/api-config-server — the backend half of the runtime config flow, which answers the api-config endpoint from package-owned allowlist plugins. Auto-invoked when serving API config from a server app or deciding what a backend advertises to its clients.Votes: 0GitHub stars: 3
- Web AuthHow to use @owlmeans/web-auth — web-side authentication-plugin package that registers into the shared @owlmeans/client-auth/manager registry. It ships the development-only PK supervisor login form (appendSupervisorAuth, supervisorClientPlugin, SUPERVISOR_LOGIN_PATH). Auto-invoked when importing @owlmeans/web-auth or wiring the supervisor login into a web client.Votes: 0GitHub stars: 3
- Supervisor AuthPK-based supervisor authentication — a development-only login where a holder of one of the project's trusted private keys mints a token for any user id/email (registering them on first use), bypassing external IdPs. Primary use is end-to-end tests. Covers appendSupervisorAuth (server + web), the supervisor plugin, and the @owlmeans/test-ui helpers. Use when wiring or testing supervisor auth.Votes: 0GitHub stars: 3
- Server Oidc RpHow to use @owlmeans/server-oidc-rp — the server-side OIDC relying party — appendOidcGuard, oidcEntrypoints and makeAuthServiceEntrypoints, the OidcClientService and its adapter, the requested-scope contract, the UMA2 gate, the wrapped-token service, the acting organization of a tenanted session and its switch, and the owned public types that keep openid-client out of the public surface. Auto-invoked when importing server-oidc-rp helpers or configuring identity providers on a server.Votes: 0GitHub stars: 3
- Server OauthHow to use @owlmeans/server-oauth — the OAuth 2.1 authorization server for an OwlMeans backend: appendOAuthServer, the raw Fastify routes (RFC 8414/9728 metadata, authorize, device_authorization, token, register, revoke), static/CIMD/DCR clients and the SSRF guard, the pending-record store, the session-guarded consent handlers, oauthMetadataOf(ctx).protectedResourceChallenge for resource servers, and the lazy URL options. Auto-invoked when adding sign-in-by-browser to an API, mounting the con...Votes: 0GitHub stars: 3
- Server Auth SessionHow to use @owlmeans/server-auth-session for absolute seven-day bearer/OIDC session tracking, Redis authority, local memory defaults, and profile-level fence/refresh/revoke decisions. Use when issuing, validating, revoking, or refreshing OwlMeans sessions.Votes: 0GitHub stars: 3
- Server Auth IdentityHow to use @owlmeans/server-auth-identity — the Mongo-backed identity store shared by a deployment's own sign-in and the apps it hosts. One account per e-mail (every sign-in method a credential on it), a personal organization per account, profile rows per (account, app, organization) with a computed profileId, organization groups, the IdentityLinkingService for the deployment's own app, the identityOf(ctx) ensureAccount / ensureProfile primitives, the EntityResolverService with field-level re...Votes: 0GitHub stars: 3
- OauthHow to use @owlmeans/oauth — the shared layer of OwlMeans OAuth sign-in: the two grants (device authorization RFC 8628, authorization code + PKCE S256), the consent protocols (makeOAuthProtocols), the `_oauth` flow, fetch-only client helpers (discovery, device authorization, polling, revoke), user/device-code and redirect-URI matching, and the error family incl. SignInRequired. Auto-invoked when a project needs an authorization server, a browser consent screen or a CLI/MCP browser sign-in, wh...Votes: 0GitHub stars: 3
- Mailer SmtpHow to use @owlmeans/mailer-smtp — SMTP transport (nodemailer) for the MailerService contract. Use when configuring real outbound email, an SMTP relay such as Mailgun, or the email-OTP mailer. Applies to files matching **/context.ts, **/config.ts, **/setup.ts.Votes: 0GitHub stars: 3
- Basic KeysHow to use @owlmeans/basic-keys — Ed25519 keypair generation, signing/verification, key model, and auth plugins (built on @noble/curves and @noble/hashes). Auto-invoked when importing keypair utilities or implementing crypto-based auth.Votes: 0GitHub stars: 3
- AuthHow to use @owlmeans/auth — the core authentication and authorization vocabulary shared by server and client, covering the Auth / AuthPayload / AuthCredentials types, the AuthRole and AuthenticationType enums, the error hierarchy (AuthUnknown, AuthenFailed, AuthForbidden …), the request JSON schemas, the entrypoint aliases, and authHelper.entitySlugOf for reading the organization entity off a token. Auto-invoked when importing auth types, errors, schemas or constants, or when working with req...Votes: 0GitHub stars: 3
- Auth TokenHow to use @owlmeans/auth-token — the contracts behind long-lived access tokens (API keys) — the token format and its deployment prefix, the three management routes, the Authorization parsing that Bearer needs, and the client-side carrier guard a CLI or an MCP server authenticates with. Auto-invoked when importing the token entrypoints, the carrier guard, parseAuthorizationHeader, or an access-token type.Votes: 0GitHub stars: 3
- Auth ProtocolComprehensive reference for the OwlMeans authentication and authorization protocol — the Ed25519, OIDC, provider-backed local identity, email-OTP, hosted-app (integrated provider) and PK-supervisor paths, the identity model (one account per e-mail, credentials on the account, profile rows per app and organization, organizations with groups), pairwise subjects, the acting organization as session state and its switch, the four permission kinds, the core types and error hierarchy, guards and gat...Votes: 0GitHub stars: 3
- Api Config ServerHow to use @owlmeans/api-config-server — the backend half of the runtime config flow, which answers the api-config endpoint from package-owned allowlist plugins. Auto-invoked when serving API config from a server app or deciding what a backend advertises to its clients.Votes: 0GitHub stars: 3
- SecurityUse when the user asks for a security review, vulnerability scan, security audit, or to check code for security issues, front end or back end.Votes: 0GitHub stars: 3
- HardenSecurity audit: threat model, OWASP Top 10 (and LLM Top 10), abuse cases, dependency and secret scan, with ranked findings and concrete fixes. Read-only.Votes: 0GitHub stars: 10
- Security And HardeningHardens code against vulnerabilities. Use when handling user input, authentication, data storage, or external integrations. Use when building any feature that accepts untrusted data, manages user sessions, or interacts with third-party services. Use when personal data or privacy compliance (GDPR, CCPA) is involved.Votes: 0GitHub stars: 3
- Xss AnalysisAnalyze and validate cross-site scripting in web/UI code — use when reviewing HTML sinks, DOM APIs, template escaping, dangerouslySetInnerHTML, or reflected/stored XSS paths (CWE-79 / A03:2021).Votes: 0GitHub stars: 15
- Websocket SecurityAnalyze WebSocket security posture — use when reviewing WS/WSS upgrade auth, origin checks, message authorization, or cross-site WebSocket hijacking risks (CWE-346 / CWE-352 / A01:2021).Votes: 0GitHub stars: 15
- Threat ModelingLightweight threat modeling for an application before deep scanning — map assets, trust boundaries, and abuse cases; feeds /axguard-audit.Votes: 0GitHub stars: 15
- Supply Chain SecurityAssess install hooks, curl|sh, untrusted indexes, and integrity gaps in dependency/build pipelines before ship (CWE-494 / CWE-506 / A06:2021 / A08:2021).Votes: 0GitHub stars: 15