Name: db-security
Author: ziyabeey

Instruction file imported from ziyabeey/randevu (.github/instructions/db-security.instructions.md). Copyright stays with the author.

DB, security and concurrency invariants

Use the task's accepted contracts and R1 review procedure. These file-scoped instructions do not assign the reader the R1 role.

Business is the tenant root. Client IDs/cookies do not grant authority: validate Auth, active Membership, RLS and cross-tenant fail-closed behavior.
Inspect every executable surface, not just table grants: SECURITY DEFINER, pinned search_path, EXECUTE grants, views/RPCs and recovery-session boundaries. Never add a service-role key to the Worker.
Keep accepted migrations immutable; use only an assigned forward migration, with clean/historical-upgrade proof and explicit grants/RLS.
Inspect row/advisory lock ordering and FK KEY SHARE interaction. A weaker lock mode is not a repair without preserved authority and real concurrency proof.
Prove CAS/stale-write fences, idempotency and changed-intent rejection, atomicity, zero half-state/orphans, snapshot/audit and provider evidence.
Use real timestamptz instants and business IANA timezone. PostgreSQL exclusion constraints including buffers remain the final staff-conflict guard.
Money is server-computed; closed financial history cannot be silently mutated. Estimates are not definitive charges.

No silent weakening of accepted invariants. A green test summary alone is not independent DB/security acceptance or proof of an exact failure cause.

# after Install: the listing is in your workspace's routing pool - a plan picks it for its slot curl -s -X POST https://api.opensmartroute.ai/api/v1/route -H 'Authorization: Bearer $OSR_API_KEY' -H 'Content-Type: application/json' -d '{"text": "...", "plan": true}'

Install db-security and it becomes one more candidate the router can pick - when it fits.

A listing is a routing target with a manifest: what it does, which domains it covers, what it costs and who publishes it. Once installed it sits beside your own models and tools, is scored like any other candidate for each request, and shows up in the trace when it wins. Ratings come from workspaces that installed it, one per account.

{ "ocm": "1", "id": "ziyabeey-randevu-db-security-instructions", "kind": "skill", "name": "db-security", "description": "Use the task's accepted contracts and [R1 review procedure](../skills/r1-db-security-review/SKILL.md). These file-scoped instructions do not assign the reader the R1 role.", "publisher": "ziyabeey", "version": "1.0.0", "capabilities": { "domains": [ "math", "data_analysis" ], "tags": [ "skill-md", "github-instructions" ], "languages": [ "en" ] }, "quality_prior": 0.6, "examples": [ "Use the task's accepted contracts and [R1 review procedure](../skills/r1-db-security-review/SKILL.md). These file-scoped instructions do not assign the reader the R1 role." ], "primary": false, "metadata": { "source": { "provider": "github-instructions", "repository": "https://github.com/ziyabeey/randevu", "path": ".github/instructions/db-security.instructions.md", "ref": "c1eb864067085b430c27bebfe12581104f98f5a5", "url": "https://github.com/ziyabeey/randevu/blob/c1eb864067085b430c27bebfe12581104f98f5a5/.github/instructions/db-security.instructions.md", "key": "ziyabeey/randevu/.github/instructions/db-security.instructions.md" }, "applies_to": "supabase/**/*.sql,worker/**/*.ts" }, "instructions": "# DB, security and concurrency invariants\n\nUse the task's accepted contracts and\n[R1 review procedure](../skills/r1-db-security-review/SKILL.md).\nThese file-scoped instructions do not assign the reader the R1 role.\n\n- Business is the tenant root. Client IDs/cookies do not grant authority:\n validate Auth, active Membership, RLS and cross-tenant fail-closed behavior.\n- Inspect every executable surface, not just table grants: SECURITY DEFINER,\n pinned `search_path`, EXECUTE grants, views/RPCs and recovery-session boundaries.\n Never add a service-role key to the Worker.\n- Keep accepted migratio", "cost": { "context_tokens": 362 } }

db-security

About

DB, security and concurrency invariants

Use it

Install db-security and it becomes one more candidate the router can pick - when it fits.

Manifest

Reviews