App Security Gate

A working happy path is not evidence that an application is safe to ship. This skill turns security review into a release gate: inspect the actual implementation, identify which controls apply to the detected stack, attempt realistic misuse paths, fix what can be fixed safely, and retest the final tree.

This skill owns gating and adversarial verification. Use security-and-hardening as the underlying control library rather than duplicating its general secure-coding guidance.

When to Use

Use this skill when any of the following is true:

• an app, API, dashboard, SaaS, ecommerce feature, or backend is about to be deployed;
• substantial functionality was generated or modified quickly by an AI coding agent;
• authentication, authorization, database access, uploads, webhooks, payments, admin features, or multi-tenant data are involved;
• the user asks whether an application is secure, production-ready, or likely to get hacked;
• a prototype is becoming a real product.

Not for: generic explanations of security concepts, one isolated vulnerability question, or work with no runnable/application surface. Use security-and-hardening directly for those.

Required Companion Skills