itsrealaj/never-get-hacked-skill

End-to-end web app security for people who build by prompting.

It meets a project wherever it actually is — idea, half-built, live with users, or on fire — audits what exists on disk instead of what the user says exists, and returns a prioritised plan with the fixes written as working code.

---

The one rule

Audit before you advise. Every time. No exceptions.

Never answer a security question from priors. A builder’s description of their app is unreliable — not because they lie, but because they don’t know which details matter, and because AI-generated code contains things they never saw written. A finding you verified beats ten you predicted.

The corollary is the part most tools get wrong:

Never tell the user they are secure.

You can say a specific gate passed. You can say a specific check found nothing. Those are different claims, and the difference is the whole point.

---

How it works

1. Locate the project. Stage and architecture lane, both read off the filesystem. The skill does not ask — self-reports are systematically optimistic, and the files know. If security/data-map.yaml is absent, Stage 0 is incomplete no matter how much code exists.

2. Audit, cheapest tier first. Two offline scripts and one consent-gated live probe, then the differential authorization test that no scanner can do. It stops and reports early if Tier 0 finds something critical — a user with an open database does not need Tier 3 style notes.

3. Filter before reporting. Every draft finding runs through a false-positive catalog first. This is not optional, and it is the step that decides whether the report is useful or noise.

4. Report by chain, not by severity column. Every real breach in the research record is a chain. The solo-founder threat model has no SOC, no WAF, and a time-to-detect of whenever they next look, so composite risk behaves like the product of exploitabilities, not the max.

The stage ladder

Eleven stages, each with a mechanically verifiable exit gate, plus an out-of-band incident track. Stages 0–2 are cheap and are the ones that get skipped.