App Security

Review Laravel apps for auth, CSRF, XSS, Eloquent safety and API security

Secure trading agents against prompt injection, runaway spend and key leaks

Review MCP config files for mutable package references before approval or CI

Harden Perl input handling, process execution, DBI queries and web code

Secure Quarkus apps with JWT and OIDC auth, RBAC, validation and rate limiting

Install the repo-scan source audit from a pinned, reviewable commit

Hunt remotely reachable vulnerabilities in a repo that qualify for bounty reports

Scan Claude Code settings, hooks and MCP servers for security misconfigurations

Set up the 1Password CLI and read or inject secrets safely

Audit code for security issues with static findings and suggested repairs

Harden code against OWASP risks in input handling, auth and data storage

Create, rotate and revoke OmniRoute API keys and inspect their scopes

Create and rotate OmniRoute API keys with per-key scopes, limits and expiry

Authenticate OmniRoute API calls with bearer tokens, sessions and login rules

Scan project dependencies for known vulnerabilities and CVEs before releases

Scan declared MCP servers in a harness for security findings and fail on severity

Bundle manifest, threat model and MCP scan into one timestamped audit record

Generate a review-grade threat model of MCP surface threats with severity ratings

Find personal data like emails, phone numbers and API keys before committing

Scan untrusted input for prompt injection and unsafe content before a model sees it

Run quick, standard or deep security scans on a codebase before production deploys

Automate Bitwarden tasks with the Rube MCP toolkit from Composio

Automate Doppler Secretops tasks with the Rube MCP toolkit from Composio

Automate Identitycheck tasks with the Rube MCP toolkit from Composio

Automate Lastpass tasks with the Rube MCP toolkit from Composio

Request code signing for release builds through SignPath via Composio Rube MCP

Remove eval and other unsafe dynamic code execution from scripts

Add a content security policy header that blocks injected scripts and sources

Set cross-origin isolation headers for apps that need SharedArrayBuffer and workers

Lock down CORS and cross-origin requests so only trusted sites can call your API

Audit project dependencies for known vulnerabilities and wire checks into CI

Add bot and abuse protection to public forms without hurting accessibility

Confirm every form and fetch call submits data only over HTTPS

Set HSTS headers so browsers only ever connect to your site over HTTPS

Serve the whole site over HTTPS with a valid and renewed certificate

Find hardcoded http links and fix them so pages do not downgrade to HTTP

Use secure, up to date JavaScript libraries and replace risky old versions

Find API keys, tokens and credentials leaked in client code or git history

Find HTTP resources loaded on HTTPS pages and switch them to secure URLs

Add rel noopener noreferrer to links that open in a new tab

Secure password fields with safe autocomplete, HTTPS and browser policies

Set a Permissions-Policy header that turns off camera, mic and other features

Set a Referrer-Policy header that limits what URLs leak to other sites

Set Secure, HttpOnly and SameSite flags on session cookies

Stop error responses from exposing stack traces and internal details

Add Subresource Integrity hashes to external scripts so tampering is blocked

Store auth tokens safely so XSS attacks cannot steal them from the browser

Set X-Content-Type-Options to stop browsers guessing MIME types

Set X-Frame-Options to block clickjacking on pages with user actions