security▌

You are an expert in JSON Web Token (JWT) security implementation. Follow these guidelines when working with JWTs for authentication and authorization.

Security rules for building secure LLM applications, based on the OWASP Top 10 for LLM Applications 2025.

.NET / C# 二进制逆向。当目标是 .NET assembly（PE 头含 CLR、.exe/.dll 托管程序）、C# 编译产物（含 NativeAOT）、红队 Sharp* 工具（Rubeus / SharpHound / SharpHound 等）、.NET 混淆程序（ConfuserEx / SmartAssembly / Babel / Eazfuscator）、.NET loader / info-stealer / 套壳 malware 时使用。优先用 dnSpyEx + de4dot，需要 AI 直接操作时联动 dnSpy MCP。不用于纯 native 二进制（走 reverse-engineering / ida-reverse）。

Comprehensive security checklist and patterns for authentication, input validation, and sensitive data handling. \n \n Covers 10 core security areas: secrets management, input validation, SQL injection prevention, authentication/authorization, XSS prevention, CSRF protection, rate limiting, sensitive data exposure, blockchain wallet verification, and dependency security \n Includes concrete code examples for each vulnerability type, showing both unsafe and secure patterns with TypeScript and Nex

Comprehensive security toolkit for threat modeling, penetration testing, security auditing, and cryptography implementation. \n \n Three core automated scripts: Threat Modeler for scaffolding and best practices, Security Auditor for deep analysis and recommendations, and Pentest Automator for expert-level testing automation \n Includes reference documentation covering security architecture patterns, penetration testing workflows, and cryptography implementation with code examples and anti-patter

Comprehensive security checklist covering secrets, input validation, authentication, and deployment readiness. \n \n Covers 10 critical security domains: secrets management, input validation, SQL injection prevention, authentication/authorization, XSS prevention, CSRF protection, rate limiting, sensitive data exposure, blockchain wallet verification, and dependency security \n Includes code examples for both unsafe and secure patterns across TypeScript, SQL, and configuration files \n Provides p

Trivy is a comprehensive open-source vulnerability scanner by Aqua Security that detects vulnerabilities in OS packages, language-specific dependencies, misconfigurations, secrets, and license violati

$21

Find exploitable vulnerabilities in GitHub Actions workflows. Every finding MUST include a concrete exploitation scenario — if you can't build the attack, don't report it.

Synthesizes raw learnings and codebase analysis into an interlinked Markdown Knowledge Base (KB). Use at the beginning of a loop to build or update architecture.md, entities, and vulnerabilities. Don't use for generating threat models or formulating execution plans.