Browse Skills

Hardens API endpoints with rate limiting, input validation, CORS, CSP, authentication, bot protection, and gateway security following OWASP API Security Top 10.

Designs secure authentication and authorization systems using OAuth2, OIDC, JWT, RBAC/ABAC, MFA, and Passkeys with defense-in-depth strategies.

Expert guidance for implementing passwordless authentication with WebAuthn passkeys — covering registration/authentication ceremonies, platform vs roaming authenticators, cross-device flows, conditional UI, and migration from passwords to phishing-resistant credentials.

Comprehensive application security guidance covering OWASP Top 10, authentication, authorization, encryption, secure coding practices, dependency auditing, and security architecture for building resilient software.

Design and implement privileged access management (PAM) systems including credential vaulting, just-in-time access, session management, and compliance-ready access governance for enterprise and cloud environments.

Design and implement production-grade Row-Level Security policies for Supabase applications, ensuring data isolation, multi-tenant security, and optimal query performance.

Guides secure secrets lifecycle management including storage, rotation, access control, and CI/CD integration using Vault, cloud KMS, and zero-trust patterns.

Conduct systematic security architecture reviews to identify design flaws, missing controls, and compliance gaps before deployment.

Design and implement secure webhook receiving endpoints with HMAC signature verification, replay attack prevention, idempotent processing, and secret rotation strategies.

Implement runtime security for containerized workloads including threat detection, policy enforcement, and incident response in Kubernetes.

Comprehensive API security assessment and hardening specialist that analyzes REST, GraphQL, and gRPC APIs against the OWASP API Security Top 10, identifies vulnerabilities, and produces prioritized hardening plans with implementation roadmaps.

Systematically audit and fortify OAuth 2.0 and OpenID Connect implementations against authorization code interception, redirect URI manipulation, token leakage, and scope escalation attacks using RFC-backed security best practices.

Secure IoT ecosystems from device to cloud, addressing firmware, communication, authentication, and lifecycle security challenges.

Plan and execute adversary simulation exercises using real-world TTPs to validate defensive controls and detection capabilities.

Integrate security tooling and practices into CI/CD pipelines for automated, shift-left security at every stage of delivery.

Guides defensive penetration testing methodology including scope definition, vulnerability assessment, and remediation reporting. Follows PTES and OWASP Testing Guide frameworks with strict defensive-only guardrails.

Designs zero trust architectures based on NIST SP 800-207 and BeyondCorp principles. Covers identity-based access, micro-segmentation, software-defined perimeters, and migration strategies from perimeter-based security.

Conducts comprehensive security audits of iOS and Android applications, covering OWASP Mobile Top 10, data storage, network communication, authentication, and binary protections with actionable remediation guidance.

Performs security-focused code reviews identifying vulnerabilities, misconfigurations, and insecure patterns across OWASP Top 10 categories with actionable fix recommendations.

Advises on cryptographic implementation including encryption at rest/in transit, key management (KMS/HSM), TLS configuration, hashing algorithms, digital signatures, and post-quantum readiness. Focuses on correct usage of proven primitives rather than custom cryptography.

Guides organizations in embedding security throughout every phase of the Software Development Lifecycle, from requirements gathering through deployment, using industry frameworks like BSIMM, OWASP SAMM, and threat modeling methodologies.

Designs tamper-evident consent logging architectures that provide audit-complete proof of user consent across GDPR, CCPA/CPRA, and ePrivacy regulations, with immutable event sourcing and real-time consent signal propagation.

Design and implement zero trust architecture patterns including identity-centric access, microsegmentation, continuous verification, and least-privilege enforcement across cloud and hybrid environments.

Expert guidance for designing, deploying, and maintaining Content Security Policy (CSP) headers that effectively prevent XSS, data injection, and content integrity attacks across modern web applications.