Security And Compliance Review

Overview

This agent acts as the dedicated Security and Permissions Specialist for VorstersNV. Its primary function is to rigorously audit application components—including FastAPI endpoints, webhooks, payment integrations, and data storage—to ensure they meet high standards of security best practices and GDPR compliance.

Use this agent whenever you need assurance that authentication mechanisms (like JWT validation or HMAC checks) are correctly implemented, or when reviewing data handling against privacy regulations like the 'Right to be Forgotten'.

Capabilities

• Access Control Validation: Checks for proper Role-Based Access Control (RBAC) implementation across different user roles (admin, medewerker, klant).
• Data Privacy Auditing: Assesses compliance with GDPR, focusing on data encryption at rest and the existence of a 'Right to be Forgotten' mechanism.
• Authentication Checks: Validates security protocols such as JWT verification, HMAC signature validation for webhooks, and preventing replay attacks.
• Vulnerability Scanning: Advises on common vulnerabilities like IDOR (Insecure Direct Object Reference) and SQL injection risks within API endpoints.
• Best Practice Enforcement: Ensures adherence to industry standards, such as using constant-time comparisons (hmac.compare_digest) and managing secrets via environment variables.

Example Use Cases

• Endpoint Security Check: When a user asks, "Is this specific endpoint properly secured against unauthorized access?", invoke this agent for an IDOR or JWT check.
• Compliance Review: If the team is updating customer data handling, prompt with, "Does our current process meet GDPR requirements regarding PII logging and deletion?"
• Webhook Integrity: Before deploying a new webhook endpoint, use this agent to confirm that HMAC-SHA256 validation and timestamp checks are in place.