The Agent Skills Directory

[SAFE]: The skill recommends using well-established, community-standard gems (Devise, Pundit, Rodauth, devise-jwt) rather than implementing custom authentication logic, which aligns with industry security best practices.
[SAFE]: Explicitly mandates secure configuration defaults for the provided implementation patterns, including minimum password lengths of 12 characters, bcrypt cost factors (stretches) of 12, and the use of application peppers stored in secure credentials to mitigate offline cracking.
[SAFE]: Includes specific instructions to prevent common vulnerabilities, such as implementing account lockouts to thwart brute-force attacks and requiring email confirmation to prevent account takeover via email stealing in public-facing applications.
[SAFE]: Promotes the use of Pundit Scopes and automated verification hooks ('verify_authorized' and 'verify_policy_scoped') in controllers to ensure that data access is consistently authorized, preventing horizontal privilege escalation and accidental data leaks.
[SAFE]: Provides guidance on securing API authentication, recommending short-lived JWTs combined with a denylist revocation strategy to reduce the impact of token leakage.
[SAFE]: Warns against insecure patterns such as open redirects using 'params[:redirect_to]' and half-cleared sessions during sign-out, providing safe implementation alternatives.

devise-pundit-rodauth