Why must communityId be included in every query?

Including communityId in every filter ensures that users can only access data belonging to their specific community, preventing critical security breaches and cross-tenant data leaks.

How does this skill improve database performance?

The skill enforces specific indexing patterns where communityId is always the first field in compound indexes, optimizing query execution for tenant-isolated data lookups.

Does this skill apply to the Community collection?

No. The Community collection itself acts as the tenant root and does not contain a communityId field; queries against it are typically restricted to administrative operations using the primary ID.

Why is getting communityId from the request body forbidden?

Request bodies can be easily forged by attackers. To ensure security, the communityId must always be extracted from a verified JWT token via the controller's request context.

Aegis Multi-Tenancy Enforcer

Name: Aegis Multi-Tenancy Enforcer
Author: muhammadcaeed

bymuhammadcaeed

0•

보안 및 테스팅

Enforces strict data isolation by ensuring community identification is mandatory across all MongoDB queries and service layer logic.

The Aegis Multi-Tenancy Enforcer is a specialized skill designed to prevent cross-community data leaks within multi-tenant platforms. It provides Claude with rigorous patterns for repository methods, service logic, and database indexing, ensuring that every database operation is scoped to a specific communityId. By prioritizing communityId extraction from secure JWT tokens rather than untrusted request bodies, this skill hardens the application against unauthorized access and common multi-tenant security vulnerabilities.

주요 기능

01Multi-stage aggregation pipeline validation

02Secure JWT-based tenant identification enforcement

03Detection and prevention of insecure global query anti-patterns

04Mandatory communityId query injection for all CRUD operations

05Optimized compound index patterns for tenant isolation

060 GitHub stars

사용 사례

01Designing high-performance database indexes for community-scoped data

02Developing secure repository methods for multi-tenant NestJS applications

03Auditing MongoDB queries to prevent cross-tenant data exposure

What are Skills?·How to Install

Install with 🐟 Skill.Fish

npx skillfish add muhammadcaeed/aegis tenancy-enforcer.md

For use in Claude.ai and ChatGPT

주요 기능

01Multi-stage aggregation pipeline validation

02Secure JWT-based tenant identification enforcement

03Detection and prevention of insecure global query anti-patterns

04Mandatory communityId query injection for all CRUD operations

05Optimized compound index patterns for tenant isolation

060 GitHub stars

사용 사례

01Designing high-performance database indexes for community-scoped data

02Developing secure repository methods for multi-tenant NestJS applications

03Auditing MongoDB queries to prevent cross-tenant data exposure

What are Skills?·How to Install

Install with 🐟 Skill.Fish

npx skillfish add muhammadcaeed/aegis tenancy-enforcer.md

For use in Claude.ai and ChatGPT