SaaS Cybersecurity

An evidence-based, provider-aware Agent Skill for auditing and safely hardening SaaS web applications without breaking product behavior.

saas-cybersecurity gives Codex, Claude Code, and other coding agents a reusable defensive workflow for OWASP-aligned review, hosting compatibility, browser/runtime verification, regression-safe remediation, and honest final reporting.

Why this skill exists

Web security is not a checklist of headers. A safe review has to understand the actual framework, deployment topology, trust boundaries, payment and upload lifecycles, browser behavior, provider-managed controls, and the regressions introduced by hardening.

This skill requires an agent to:

  • detect the framework, runtime, hosting provider, and effective security layer before changing configuration;
  • review the complete control catalog, including OWASP risks, authentication, tenant isolation, payments, uploads, privacy, availability, link injection, and supply-chain integrity;
  • distinguish positive evidence from regex-based leads and unknown external settings;
  • use an available browser, Chrome session, Playwright, or HTTP client only when runtime evidence is necessary;
  • apply changes in small reversible batches with baseline comparison and focused regression tests;
  • report what was already correct, what failed, what was improved, what was implemented, what was verified, and what remains blocked or external.

Coverage

The control catalog includes:

  • HTTP security headers, CSP, clickjacking, CORS, CSRF, cookies, TLS, and HSTS safety;
  • SQL/NoSQL/command/template/header injection and unsafe deserialization;
  • authentication, sessions, password recovery, JWTs, MFA, and access control;
  • XSS across reflected, stored, DOM, attribute, SVG, upload, Markdown, and third-party-script paths;
  • secrets, PII, caching, browser storage, logging, and cryptography;
  • payments, signed webhooks, idempotency, amount/currency binding, and failed-payment cleanup;
  • uploads, private storage, content verification, ownership, delivery, and lifecycle cleanup;
  • SSRF, open redirects, hidden links/text/iframes, cloaking, malicious scripts, and indexing control;
  • rate limiting, body/time/concurrency/resource limits, ReDoS, and queue safety;
  • vulnerable dependencies, lockfiles, lifecycle scripts, CI/CD, artifact integrity, and CDN/SRI;
  • insecure design, workflow invariants, client trust, and defense in depth.

See the complete control catalog.

Safety model

This is a defensive skill for systems the user owns or is explicitly authorized to test. It does not authorize brute force, credential testing, persistence, destructive denial-of-service traffic, malware execution, unauthorized scanning, production-data modification, real charges, or third-party account changes.

Static triage does not certify an application as secure. PASS requires positive evidence. Provider dashboards, DNS, WAF, certificates, production secrets, and other external controls are reported as EXTERNAL or BLOCKED until verified.

Installation

Codex — user skill

macOS/Linux:

git clone https://github.com/YankielDBC2/saas-cybersecurity.git ~/.codex/skills/saas-cybersecurity

Windows PowerShell:

git clone https://github.com/YankielDBC2/saas-cybersecurity.git "$env:USERPROFILE\.codex\skills\saas-cybersecurity"

Restart or refresh Codex if the skill is not discovered automatically, then invoke it as $saas-cybersecurity.

Claude Code — user skill

macOS/Linux:

git clone https://github.com/YankielDBC2/saas-cybersecurity.git ~/.claude/skills/saas-cybersecurity

Windows PowerShell:

git clone https://github.com/YankielDBC2/saas-cybersecurity.git "$env:USERPROFILE\.claude\skills\saas-cybersecurity"

Invoke it as /saas-cybersecurity, or let Claude load it automatically from its description.

For one repository only, place this repository at .claude/skills/saas-cybersecurity/ or copy the complete folder there. Keep SKILL.md, references/, and scripts/ together.

Other coding agents

Point the agent's skill/instruction loader at SKILL.md and preserve relative access to references/ and scripts/. Agents that do not implement automatic skill discovery can be prompted to read SKILL.md before starting an authorized security audit.

Usage

Audit without edits:

Use $saas-cybersecurity to audit this application. Do not change code. Produce the full evidence matrix and prioritize confirmed findings.

Audit and harden:

Use $saas-cybersecurity to audit and safely harden this SaaS. Detect the hosting provider, implement compatible in-scope fixes in small batches, verify critical flows, and write the final report.

Release gate:

Use $saas-cybersecurity as a release gate. Separate implemented, configured, runtime-verified, external, and blocked controls.

Deterministic static triage

The optional Node.js script has no third-party dependencies and supports Windows, macOS, and Linux with Node.js 18 or newer.

node scripts/audit.mjs /path/to/application
node scripts/audit.mjs /path/to/application --format json
node scripts/audit.mjs /path/to/application --format markdown --output security-triage.md

The script detects common frameworks/providers, records positive configuration evidence, and flags candidate sinks with file and line references. It redacts high-signal credential patterns. Its output is triage—not a vulnerability verdict.

Repositories may add a .saas-cybersecurity-ignore file with one exact relative path or directory prefix per line. Exclusions are intentionally simple, visible, and reported in JSON output; do not use them to hide unreviewed application code.

Repository validation

npm test
npm run validate
npm run audit:self

GitHub Actions runs the test and validation suite on Linux, Windows, and macOS with supported Node.js versions.

Architecture

Contributing and security reports

Read CONTRIBUTING.md before proposing changes. Report vulnerabilities according to SECURITY.md, without posting live secrets, private customer data, or exploitable third-party targets publicly.

License

MIT. See LICENSE.