Secure-by-Default

Use this skill to review and harden a React Native + Next.js codebase with practical, high-signal checks.

Principles:

• Prefer “deny by default” at trust boundaries (server APIs, server actions, deep links).
• Every finding must include (1) evidence and (2) a concrete remediation.
• Don’t demand tooling the repo doesn’t use; but do call out missing guardrails.

Workflow

1. Identify entry points and trust boundaries.

• Next.js: API routes, server actions, middleware, auth flows, data fetching.
• React Native: network calls, deep links, local storage, push notification handlers.