app-security-gatelisted

# App Security Gate A working happy path is not evidence that an application is safe to ship. This skill turns security review into a release gate: inspect the actual implementation, identify which controls apply to the detected stack, attempt realistic misuse paths, fix what can be fixed safely, and retest the final tree. This skill owns **gating and adversarial verification**. Use `security-and-hardening` as the underlying control library rather than duplicating its general secure-coding guidance. ## When to Use Use this skill when any of the following is true: - an app, API, dashboard, SaaS, ecommerce feature, or backend is about to be deployed; - substantial functionality was generated or modified quickly by an AI coding agent; - authentication, authorization, database access, uploads, webhooks, payments, admin features, or multi-tenant data are involved; - the user asks whether an application is secure, production-ready, or likely to get hacked; - a prototype is becoming a real product. **Not for:** generic explanations of security concepts, one isolated vulnerability question, or work with no runnable/application surface. Use `security-and-hardening` directly for those. ## Required Companion Skills - Load `security-and-hardening` for control-level guidance. - Use `verification-before-completion` for evidence discipline. - Use `verification-gauntlet` when the project supports Agentit's runnable verification probes. - For Supabase/Postgres projects, also load `sup