Secure Full-Stack Feature Implementation
Build database-to-UI features with scoped authorization, validated writes, and security regression tests.
Before & after
Same prompt, same agent — the only difference is the skill.
I can help you build a signup form with password reset and email verification. There are a few different approaches we could take here. First, do you have a preference on the tech stack? Are you using React, Vue, Svelte, or something else? On the backend, would you prefer Node.js, Python, or another framework? Also, are you storing passwords in your own database or using a third-party auth provider like Auth0? I could build this as a simple form submission or set up a more sophisticated flow with tokens. Once you let me know your stack preferences and requirements, I can draft the implementation. I'm also happy to add CSRF protection and rate limiting if that matters to you.
SIGNUP FORM + PASSWORD RESET FLOW
FRONTEND COMPONENTS
• Signup form: Email field (validated as RFC 5321), password field with strength meter, honeypot field
• Email verification modal: 6-digit code input, resend button (60-second throttle)
• Password reset: Email lookup, reset token entry, new password form
BACKEND ENDPOINTS
POST /auth/signup
→ Input: email, password, honeypot
→ Validation: Email domain whitelist check (reject masked addresses), password minimum 12 chars, complexity
→ Hash: bcrypt at cost 12, never log plaintext
→ Action: Insert user, send verification email with 10-minute expiry token
→ Return: 201 Created (user ID only, no session yet)
POST /auth/verify-email
→ Input: userId, verificationToken
→ Action: Check token expiry and hash match, set emailVerified flag, delete token
→ Return: 200 with access token
POST /auth/request-password-reset
→ Input: email
→ Action: Check if user exists (log nothing if not—timing attack mitigation), send reset link if found
→ Return: Always 200 (don't leak user existence)
POST /auth/reset-password
→ Input: resetToken, newPassword
→ Validation: Token freshness, password complexity
→ Action: Bcrypt new password, delete all sessions
DATABASE SCHEMA
• Users table: id, email (unique index), passwordHash (bcrypt), emailVerified (bool), createdAt
• EmailTokens table: userId (FK), token (salted hash), expiresAt, type ('verify' or 'reset')
→ Never store plaintext tokens
SECURITY CHECKLIST
✓ All passwords bcrypt cost 12+
✓ Tokens hashed before storage
✓ Parameterized queries throughout (no string concatenation)
✓ Email sending rate-limited (1 per 30 sec per user)
✓ CSRF tokens on all state-changing forms
✓ No user-existence leaks (same response time for missing/invalid email)
✓ Session invalidation on password reset
✓ Honeypot field (reject if filled)About this skill
Your form works, but can another user change the record by editing the request? This skill builds the complete database-to-UI feature and checks the boundaries that happy-path implementations miss: server-side identity, resource ownership, writable fields, and safe rendering.
What it does
- Defines the request, response, validation, and authorization contract before connecting the layers.
- Implements database reads and writes scoped to the authenticated user or tenant.
- Connects forms to endpoints with loading, validation, expired-session, and failure states.
- Prevents mass assignment, unsafe query construction, and inappropriate HTML rendering.
- Adds focused tests for unauthenticated requests, wrong-owner access, forged fields, and invalid writes.
- Separates implemented behavior, executed checks, and remaining integration requirements.
What you get
A working vertical feature in your existing stack: schema changes when needed, backend handlers, frontend integration, and targeted regression tests. For pasted code or a narrow bug, you get the smallest useful correction and the test that exposes the failure.
Best for
Developers building authenticated CRUD, account settings, tenant dashboards, and other web features that cross frontend, backend, and database boundaries.
SKILL.md preview
---
name: secure-full-stack-feature-implementation
description: "Build connected database, backend, and frontend features by defining the request contract, enforcing identity and resource access on the server, and testing adversarial paths alongside the UI. Use when the user says \"build an authenticated CRUD feature\", \"connect this form to my API\", \"add an endpoint and a settings page\", \"my users can edit each other's records\", \"the form validates but the API accepts anything\", \"review this database-to-UI flow\", or \"make this full-stack feature secure\"."
---
# Secure Full-Stack Feature Implementation
… (sign up to view the full skill)More development skills
View all Development skills →Threat Hunting and IOC Triage
Turn telemetry and threat indicators into scoped hunts, evidence-backed findings, and prioritized investigation steps.
Secrets Vault Setup, Rotation, and Access Audits
Set up managed secret stores, wire workload access, rotate credentials safely, and audit least-privilege policies.
Application Penetration Test and Fix Plan
Assess application and API vulnerabilities with reproducible evidence, exploitability rankings, specific fixes, and retest steps.
Application Security Triage and Remediation
Turn code, dependency, and control findings into evidence-backed priorities, safe fixes, and verification plans.