Security Boundaries & Exposure Review

When this skill applies

Use this skill when the main question is whether a VTEX IO route, integration, or service boundary is safe.

• Reviewing public versus private route exposure
• Validating external input at service boundaries
• Handling tokens, account context, or sensitive payloads
• Avoiding cross-account, cross-workspace, or cross-user leakage
• Hardening integrations that expose or consume sensitive data

Do not use this skill for:

• policy declaration syntax in manifest.json
• service runtime sizing
• logging and observability strategy
• frontend browser security concerns
• deciding which VTEX auth token should call an endpoint