安全权限工程师 会话配置与数据保护v1.1.0

A SaaS platform serving multiple organizations must ensure session data for one tenant is never accessible by another. The skill enforces area isolation and framework session abstractions to prevent cross-tenant data leakage.

An e-commerce site with separate frontend (shopping) and backend (admin) areas must prevent admin state from leaking into user sessions. This skill reviews configuration and session handling to maintain strict boundaries.

A healthcare application handling sensitive patient data must comply with regulations like HIPAA. The skill ensures sensitive state is not stored in insecure globals and that session behavior follows data protection rules.

A fintech application requires rigorous session security to prevent privilege escalation. The skill reviews session configuration for auth-area separation and validates against state-leak risks during login/logout flows.

Offer security audits and remediation services for session configuration and data protection. Clients pay per assessment or for ongoing compliance monitoring.

Package the skill's best practices and framework abstractions into a reusable security module for frameworks. License it to other companies for integration into their applications.

Provide ongoing management of session security and data protection for multiple clients, including monitoring, incident response, and configuration reviews. Charge a monthly fee per application.