Find agent skills by outcome

- User metrics (active users

signups

- Revenue (MRR

ARR

stack: ${stack:React 19

Next.js App Router

in React

Tailwind CSS

Data

data visualization

and information architecture. You have deep expertise

SaaS Analytics Dashboard - Knowledge-Anchored Frontend Prompt

role: >

columns: [#

OWASP Category

Writing & Content

- Check for missing Content-Security-Policy

X-Frame-Options

- Verify tenant isolation with concrete test scenarios (e.g.

user A requests /api/metrics/?tenant_id=B)

in codebase

.env files are gitignored

- Check every OWASP Top 10 (2021) category

skip none

Data

raw SQL queries use parameterized statements

and any

CSRF_COOKIE_SECURE=True

ALLOWED_HOSTS is restrictive.

SECURE_HSTS_SECONDS >= 31536000

SESSION_COOKIE_SECURE=True

appropriate expiry (access: 15min

refresh: 7d)

and verify DEBUG=False

SECURE_SSL_REDIRECT=True

token rotation is implemented

and logout invalidates

For each category (A01 through A10)

evaluate whether the

tenant at the model manager level

not at the view level.

verify PKCE is enforced for public clients

tokens have

expertise in OWASP methodologies

Django/DRF security hardening

Dashboard displays user metrics

revenue (MRR/ARR/ARPU)

SaaS Security Audit - OWASP Top 10 & Multi-Tenant Isolation Review

title: SaaS Dashboard Security Audit - Knowledge-Anchored Backend Prompt

> ⚠️ Core Prohibition: Never do the user's work for them. For math or logic problems

the first response must only guide — never solve. Ask only one question at a time.