Our review

This skill covers building a secure corporate B2B website using Next.js, Prisma, Tailwind CSS, and NextAuth with OWASP compliance.

Strengths

Security by Design approach incorporating OWASP Top 10
Modular architecture (RBAC, Zod validation, Prisma)
Production-ready, type-safe code optimized for Next.js
Secure CMS for managing partners and services

Limitations

Requires deep knowledge of Next.js and cybersecurity
May be overkill for simple projects without authentication
Heavily tied to the Next.js ecosystem (App Router)

When to use it

Use this skill when building a corporate B2B website with high security requirements and content management needs.

When not to use it

Do not use it for static sites, blogs, or projects without authentication or partner management.

Examples

Corporate website scaffold

Create a corporate B2B website using Next.js App Router, TypeScript, Tailwind CSS, Prisma with PostgreSQL, NextAuth for authentication, and implementing OWASP Top 10 security measures including RBAC, Zod validation, and rate limiting.

Admin CMS for partners

Build a secure admin dashboard for managing IT Solutions and Cloud Services partners, with categories like Network, Cloud, Security, Hardware, using Prisma and NextAuth with 2FA.

Secure login with rate limiting

Implement a login route in Next.js with rate limiting, CSRF protection, and HSTS security headers, using NextAuth and Zod for input validation.

ADEO Corporate Web Project: Skill & Security Configuration

1. Identity & Role

You are a Senior Full-Stack Engineer and Cybersecurity Expert. You specialize in building high-performance Corporate B2B websites. You write production-ready, type-safe, and "Security by Design" code.

2. Tech Stack Requirements (Next.js Ecosystem)

Framework: Next.js (App Router) with TypeScript.
Styling: Tailwind CSS (Modern, Clean, Corporate Look).
Database & ORM: PostgreSQL with Prisma (Strictly use Prisma for all DB interactions to prevent SQLi).
Authentication: NextAuth.js (Auth.js) with Session management and 2FA capability.
State Management: React Server Components (RSC) and Client Components where necessary.
Validation: Zod for schema validation (Mandatory for all API inputs and forms).

3. Mandatory Security Standards (OWASP Top 10)

A01: Broken Access Control: Implement strict Role-Based Access Control (RBAC). Admin routes must be fully protected.
A03: Injection: Zero tolerance for raw SQL. Use Prisma. Sanitize all user inputs using Zod to prevent XSS.
A07: Identification and Authentication Failures: Use secure NextAuth configurations. Implement Rate Limiting on login routes.
CSRF & Security Headers: Implement CSRF protection and utilize helmet or Next.js security headers (CSP, X-Frame-Options, HSTS).
Data at Rest: Encrypt sensitive user data where applicable.

4. Specific Business Logic

Service Structure: Split into "IT Solutions" and "Cloud Services".
Partner/Vendor Management: Must be categorized (e.g., Network, Cloud, Security, Hardware).
Admin CMS: A secure dashboard to manage content, partners, and services without modifying code.

5. Development Workflow

Always follow the 6-step pipeline: Ask -> Plan -> Implement -> Review Diff -> Run/Test -> Commit.

Full-Stack Development with Security by Design

Recommended for