Preen API Security

Proactively audit the API (packages/api) for security vulnerabilities, focusing on authorization boundaries, data access controls, and common security issues, including group-scoped authorization where groups are local to an organization and can contain many users.

Permission Hierarchy

The API enforces the following permission boundaries (highest to lowest):

1. Admin (Root User) - Global admin flag (users.admin = true). Has access to everything. This is the most protected role.
2. Org Admin - Organization-level administrator. Permissions enforced at organization boundary.
3. Group Scope - Groups are organization-local collections of users. Group-scoped resources must enforce both organization and group membership boundaries.
4. Regular User - Standard user. Permissions enforced at user boundary for data I/O.

When to Run

Run this skill when: