A comprehensive suite of 23 specialized security audit agents designed for Next.js + Supabase applications. These agents can be used in Claude Code to automatically analyze your codebase for security vulnerabilities and best practices.
📦 Optimized for Next.js + Supabase, but adaptable to any stack! While these agents are specifically tailored for Next.js and Supabase, the security principles and patterns they check for are universal. See Adapting to Your Stack for guidance on customizing for other frameworks.
- 23 Security Agents - Each focused on a specific security domain
- Claude Code Settings - Pre-configured permissions and MCP server integrations
- Defense in Depth - Multiple layers of security coverage
- Meta-Analysis - Strategic insights across all security reports
- Authorization Rules Writer - Automatic business rules documentation
-
Copy the
.claudedirectory to your project root:cp -r .claude /path/to/your/project/
-
Launch Claude Code in your project directory
-
The agents will be available with
@prefix (e.g.,@auth-security-auditor)
# Step 1: Generate authorization rules (prerequisite for many agents)
@authorization-rules-writer
# Step 2: Run all security agents in parallel (fastest!)
@auth-security-auditor @api-auth-checker @api-authorization-checker @input-validation-checker @input-sanitization-checker @output-sanitization-checker @query-injection-checker @rls-coverage-checker @supabase-advisor-checker @backend-authorization-checker @email-security-checker @client-secrets-checker @dependency-security-checker @triggerdotdev-security-checker @file-upload-checker @logging-exposure-checker @rate-limiting-checker @browser-security-checker @webhook-security-checker @url-validation-checker @business-logic-checker
# Step 3: Run meta-analysis for strategic insights
@security-meta-analyzerWhat you get:
docs/authorization_rules.md- Your application's business authorization rulessecurity-audit/*-report.md- 21 detailed security reportssecurity-audit/meta-analysis-report.md- Strategic analysis with prioritized roadmap
- auth-security-auditor - Supabase Auth helpers, session security, middleware
- api-auth-checker - API routes & server actions authentication
- api-authorization-checker - Business rule authorization
- rls-coverage-checker - Database RLS policies
- backend-authorization-checker - Database functions, views, triggers
- supabase-advisor-checker - Supabase security advisories
- input-validation-checker - Zod/validation library usage
- database-query-checker - SQL/NoSQL injection prevention
- url-validation-checker - URL validation, open redirect & SSRF prevention
- output-sanitization-checker - XSS prevention
- logging-exposure-checker - Sensitive data in logs
- business-logic-checker - Server-side business logic
- triggerdotdev-security-checker - TriggerDev job security
- client-secrets-checker - Secret exposure prevention
- browser-security-checker - Security headers, CSRF
- rate-limiting-checker - Rate limiting on endpoints
- webhook-security-checker - Webhook signature validation
- file-upload-checker - File upload security
- email-security-checker - Email security
- dependency-security-checker - npm audit, vulnerabilities
- Non-prescriptive - State principles, don't dictate implementations
- Context-aware - Discover existing code, then apply principles
- Documentation-driven - Fetch current docs rather than hardcode patterns
- Automatically search codebase
- Read business rules from
docs/authorization_rules.md - Query Supabase documentation via MCP tools
- Write comprehensive reports
- Single responsibility per agent
- No overlap between agents
- Clear, actionable findings
Each agent generates a markdown report with:
- Summary - High-level findings count
- Critical Issues (🔴) - Immediate vulnerabilities
- Warnings (
⚠️ ) - Security weaknesses - Properly Handled (✅) - What's working
- Recommendations - Specific fixes with file:line references
The .claude/settings.local.json includes:
- Pre-approved bash commands for security operations
- MCP server configurations (Supabase, Context7, Playwright)
- Permission settings optimized for security auditing
Many agents read docs/authorization_rules.md to understand your application-specific security requirements. Document:
- Who can access what resources
- Role-based permissions
- Multi-tenant isolation rules
- Sensitive operations requirements
- Run agents regularly - After features or before releases
- Fix critical issues first - 🔴 Critical >
⚠️ High > 🟢 Low - Update business rules - Keep authorization rules current
- Review all reports - Comprehensive security requires all layers
- Track fixes - Use reports to track remediation progress
# Step 1: Generate authorization rules (prerequisite for other agents)
@authorization-rules-writer
# Step 2: Run all security agents in parallel (fastest approach!)
@auth-security-auditor @api-auth-checker @api-authorization-checker @input-validation-checker @input-sanitization-checker @output-sanitization-checker @query-injection-checker @rls-coverage-checker @supabase-advisor-checker @backend-authorization-checker @email-security-checker @client-secrets-checker @dependency-security-checker @triggerdotdev-security-checker @file-upload-checker @logging-exposure-checker @rate-limiting-checker @browser-security-checker @webhook-security-checker @url-validation-checker @business-logic-checker
# Step 3: Run meta-analysis for strategic insights
@security-meta-analyzerAll reports will be written to security-audit/*.md
The meta-analysis report (security-audit/meta-analysis-report.md) will provide:
- Cross-cutting concerns across all reports
- Systemic patterns and root causes
- Prioritized remediation roadmap
- Vulnerability heat map
- Quick wins and strategic recommendations
Built for:
- Claude Code - Anthropic's official CLI
- Next.js applications
- Supabase backend
- TypeScript/JavaScript codebases
Uses:
- MCP (Model Context Protocol) for Supabase documentation
- Task agents for autonomous code analysis
- Write tool for generating reports
For detailed information about each agent, see .claude/agents/README.md
While optimized for Next.js + Supabase, these agents can be customized for your tech stack.
These agents work across all frameworks without modification:
- input-validation-checker
- output-sanitization-checker
- client-secrets-checker
- dependency-security-checker
- logging-exposure-checker
- rate-limiting-checker
- webhook-security-checker
- business-logic-checker
These need customization for your stack:
- auth-security-auditor - Update for your auth library patterns
- rls-coverage-checker - Adapt for your database access control
- api-auth-checker - Change API route patterns
- api-authorization-checker - Update authorization checking patterns
- backend-authorization-checker - Modify for your database system
- triggerdotdev-security-checker - Replace with your background job system
- Copy agent file from
.claude/agents/[agent-name].md - Update search patterns for your framework
- Replace documentation references (if using MCP tools)
- Keep security principles unchanged (OWASP guidelines are universal)
See individual agent files for their search patterns and modify accordingly for your stack.
MIT License - see LICENSE file for details.
Contributions welcome! Please ensure:
- Agents follow the lean, principle-based approach
- Single responsibility per agent
- Include Write tool for report generation
- Update documentation
- Issues: GitHub Issues
- Discussions: GitHub Discussions
- Documentation: See
.claude/agents/README.mdfor detailed agent docs
Created by Zubair LK for comprehensive security auditing of modern web applications.
Built with ❤️ for the Vibe coding community