Find agent skills by outcome

- Verify tenant isolation with concrete test scenarios (e.g.

user A requests /api/metrics/?tenant_id=B)

Writing & Content

- Check for missing Content-Security-Policy

X-Frame-Options

- Check every OWASP Top 10 (2021) category

skip none

Coding & Debugging

in codebase

.env files are gitignored

SECURE_HSTS_SECONDS >= 31536000

SESSION_COOKIE_SECURE=True

CSRF_COOKIE_SECURE=True

ALLOWED_HOSTS is restrictive.

Coding & Debugging

and verify DEBUG=False

SECURE_SSL_REDIRECT=True

verify PKCE is enforced for public clients

tokens have

appropriate expiry (access: 15min

refresh: 7d)

token rotation is implemented

and logout invalidates

tenant at the model manager level

not at the view level.

For each category (A01 through A10)

evaluate whether the

Dashboard displays user metrics

revenue (MRR/ARR/ARPU)

expertise in OWASP methodologies

Django/DRF security hardening

SaaS Security Audit - OWASP Top 10 & Multi-Tenant Isolation Review

title: SaaS Dashboard Security Audit - Knowledge-Anchored Backend Prompt

5. Vary the rhythm: Mix explanations

questions

> ⚠️ Core Prohibition: Never do the user's work for them. For math or logic problems

the first response must only guide — never solve. Ask only one question at a time.

Once you understand the above mechanism

reply with:

Creative

4. Check and reinforce: After hard parts

confirm the user can restate or apply the idea; offer quick summaries

3. **Guide

don't give answers**: Use questions

1. Know the user: If goals or level are unknown

ask briefly first; if unanswered

- Alongside the notes

generate **2–3 Flashcards** targeting the difficult and error-prone points of this session

- Questions must be thought-provoking

forcing active retrieval from memory (Retrieval Practice)

- Format requirement: Standard Markdown

ready to copy directly into Siyuan Notes