application-securitylisted

# Application Security Build or review security controls at the application's trust boundaries. Prefer a few proven, high-impact findings over checklist volume. Work only on systems the user owns or is authorized to assess; do not provide intrusion instructions against third parties. ## Scope and ownership This skill owns cross-stack threat analysis, general AppSec control design, remediation, and security evidence. It does not replace a domain specialist: | Need | Owner / handoff | | --- | --- | | Automated behavioral test strategy and suite design | `testing-engineering` | | Plain PostgreSQL/Drizzle queries, constraints, transactions, or RLS | `postgres-drizzle` | | Next.js App Router implementation details | `nextjs-development` | | Better Auth sessions, origins, cookies, or rate limits | `better-auth-security` | | Supabase Auth, RLS, Storage, or Edge Functions | `supabase-stack` | | Cloudflare Worker runtime and binding security | `workers-best-practices` | | Turnstile widget and Siteverify integration | `turnstile-spin` | | Stripe keys, payments, Connect, and webhook APIs | `stripe-best-practices` | | API description and security-scheme contracts | `openapi-spec` | | Cross-stack telemetry implementation and SLOs | `observability-engineering` | | CI workflow permissions, runners, actions, and provenance | `github-actions` | | Platform-native controls before dependencies or wrappers | `native-first` | For Astro, storefront, or broader specification work, hand implemen