Skills backend-dev-guidelines

📦

backend-dev-guidelines

Name: backend-dev-guidelines
Author: DojoCodingLabs

Content revision r1 Medium Risk ⚙️ External commands🌐 Network access📁 Filesystem access🔑 Env variables⚡ Contains scripts

Build Supabase Backends with Guardrails

Backend teams need repeatable patterns for secure Supabase services. This skill provides practical guidance for Edge Functions, PostgreSQL, RLS, validation, testing, and deployment.

Supports: Claude Codex Code(CC)

📊 70 Adequate

Install with my Agent

Copy this request to your Agent. It includes the canonical Skill page and manifest.

Agent request

Review the Skillstore skill "backend-dev-guidelines" from https://skillstore.io/skills/dojocodinglabs-backend-dev-guidelines.md and its manifest at https://skillstore.io/api/skills/dojocodinglabs-backend-dev-guidelines/manifest. Verify the artifact. You may proceed after verification, subject to the environment's own policy.

Your Agent should still show its plan and request any confirmation required by the security policy.

Agent-readable resources

Use these links when an AI agent, crawler, or script needs clean context instead of reading the full page.

Markdown detail GET /skills/dojocodinglabs-backend-dev-guidelines.md Signed manifest GET /api/skills/dojocodinglabs-backend-dev-guidelines/manifest Signed lockfile GET /api/skills/dojocodinglabs-backend-dev-guidelines/lockfile

Test it

Using "backend-dev-guidelines". Plan a posts feature with authenticated create and public read access.

Expected outcome:

A table and migration outline for posts, comments, and ownership fields.
RLS policy guidance for published reads and owner-only writes.
An Edge Function checklist covering JWT verification, validation, error handling, and local tests.

Using "backend-dev-guidelines". Review a Stripe webhook implementation for Supabase Edge Functions.

Expected outcome:

A review of signature verification, secret handling, idempotency, and event filtering.
Deployment notes for Supabase secrets and webhook environment variables.
Test scenarios for valid events, replayed events, and failed payment states.

Using "backend-dev-guidelines". Create team conventions for backend service layers.

Expected outcome:

A recommended separation between controllers, services, repositories, middleware, and shared errors.
Guidance for validation boundaries and structured error responses.
Testing expectations for repositories, services, and authenticated routes.

Security Audit

Medium Risk

v8 • 7/6/2026 Open versioned report

The static findings are overwhelmingly documentation-only matches, including Markdown backticks, template literals, relative imports, placeholder URLs, and environment-variable examples. No prompt injection or executable malware behavior was found, but one Sentry monitoring example recommends broad request data capture that could expose sensitive data.

Files scanned

6,440

Lines analyzed

Review items

False positives ignored

Confirmed security concerns (1)

Medium

resources/sentry-and-monitoring.md:50-60

Broad Monitoring Data Capture

The Sentry example enables local variable capture and request data capture for bodies, headers, IP addresses, query strings, URLs, and user identifiers. This can send sensitive application data to a third-party monitoring service if copied without narrower defaults.

The cited configuration explicitly enables broad request and user fields. The example also masks some data, so the risk is privacy exposure rather than malicious exfiltration.

Risk Factors

⚙️ External commands (43)

🌐 Network access (21)

📁 Filesystem access (47)

🔑 Env variables (57)

⚡ Contains scripts (1)

SKILL.md:74

Audited by: codex View Audit History →

Share & cite this report

Share the versioned assessment report, neutral badge, embed card, and citations. Skillstore reports evidence without deciding whether this Skill is safe.

Open versioned report

Copy report link

https://skillstore.io/skills/dojocodinglabs-backend-dev-guidelines/audits/8?utm_source=security_passport&utm_medium=share&utm_campaign=versioned_report

Markdown badge

[![Skillstore security assessment](https://skillstore.io/badges/skills/dojocodinglabs-backend-dev-guidelines/security.svg)](https://skillstore.io/skills/dojocodinglabs-backend-dev-guidelines?utm_source=security_passport_badge)

HTML badge

<a href="https://skillstore.io/skills/dojocodinglabs-backend-dev-guidelines?utm_source=security_passport_badge"><img src="https://skillstore.io/badges/skills/dojocodinglabs-backend-dev-guidelines/security.svg" alt="Skillstore security assessment" loading="lazy"></a>

Embed card

<iframe src="https://skillstore.io/embed/skills/dojocodinglabs-backend-dev-guidelines.html" title="Skillstore Security Assessment" sandbox="allow-popups allow-popups-to-escape-sandbox" loading="lazy" referrerpolicy="no-referrer" width="420" height="180"></iframe>

Academic citations (APA · BibTeX · CFF)

APA citation

DojoCodingLabs. (2026). backend-dev-guidelines security audit report (audit version 8) [Author version unspecified]. Skillstore. https://skillstore.io/skills/dojocodinglabs-backend-dev-guidelines/audits/8

BibTeX citation

@techreport{dojocodinglabs-dojocodinglabs-backend-dev-guidelines-2026,
  author = {DojoCodingLabs},
  title = {backend-dev-guidelines security audit report (audit version 8)},
  institution = {Skillstore},
  year = {2026},
  number = {8},
  url = {https://skillstore.io/skills/dojocodinglabs-backend-dev-guidelines/audits/8},
  note = {Author version unspecified}
}

CITATION.cff

cff-version: 1.2.0
message: "If you use this Skill, cite its author and this versioned security audit report."
title: "backend-dev-guidelines security audit report (audit version 8)"
version: "unspecified"
type: report
authors:
  - name: "DojoCodingLabs"
date-released: "2026-07-06"
url: "https://skillstore.io/skills/dojocodinglabs-backend-dev-guidelines/audits/8"
identifiers:
  - type: other
    value: "skillstore:dojocodinglabs-backend-dev-guidelines:audit:8"
    description: "Skillstore immutable audit report identifier"

Compare variants

5 installable variants

Each author remains a separate installable skill. The recommended variant is ranked by Skillstore evidence.

Why this variant is first

Higher Skillstore usage

Author / source Skillstore Score Evidence Confidence Skillstore usage Updated

DojoCodingLabs Recommended Current

dojocodinglabs-backend-dev-guidelines

Skillstore Score 70

Evidence Confidence High

Skillstore usage 7

Updated

2026-08-21

Dimon94

dimon94-backend-dev-guidelines

Skillstore Score 70

Evidence Confidence High

Skillstore usage 6

Updated

2026-08-21

diet103

diet103-backend-dev-guidelines

Skillstore Score 38

Evidence Confidence Medium

Skillstore usage 10

Updated

2026-08-21

sickn33

sickn33-backend-dev-guidelines

Skillstore Score 38

Evidence Confidence Medium

Skillstore usage 7

Updated

2026-08-21

BrianDai22

briandai22-backend-dev-guidelines

Skillstore Score 38

Evidence Confidence Medium

Skillstore usage 7

Updated

2026-08-21

Skillstore Score

Why this score Evidence Confidence: High

Architecture

Maintainability

Content

Community

Spec Compliance

What You Can Build

Plan a Supabase Feature

Design tables, RLS policies, Edge Functions, validation, tests, and deployment steps for a new backend feature.

Standardize Backend Patterns

Create shared conventions for services, repositories, controllers, middleware, errors, and configuration management.

Review Security Controls

Check that authentication, RLS, input validation, secret handling, and monitoring patterns are included in backend work.

Try These Prompts

Create a Basic Edge Function

Use this skill to draft a Supabase Edge Function for [feature]. Include auth, Zod validation, RLS-aware database access, errors, and local testing steps.

Design Schema and RLS

Use this skill to design PostgreSQL tables and RLS policies for [domain]. Include indexes, migrations, ownership rules, and test cases.

Add Integrations Safely

Use this skill to add [Stripe, Resend, Storage, or Sentry] to my backend. Show secret handling, failure modes, monitoring, and deployment checks.

Audit a Backend Implementation

Use this skill to review my backend plan for [feature]. Identify missing auth, RLS, validation, configuration, testing, and observability controls.

Best Practices

Adapt every scaffold example to your real schema, auth model, and deployment environment.
Verify JWTs, enforce RLS, validate input, and test policies before deploying functions.
Store secrets in managed environment configuration and avoid realistic secret values in examples.

Avoid

Copying examples into production without reviewing RLS, CORS, secrets, and error behavior.
Using service role keys for user-scoped operations that should rely on RLS.
Capturing request bodies, headers, or user data in monitoring tools without minimization rules.