# vtex-io-security-boundaries

Guides coding assistants when auditing route exposure and data boundaries in VTEX IO apps. Prevents tenant leaks and enforces payload validation.

- skill · `type=skill` · Claude Code, Codex, Cursor, GitHub Copilot, Gemini CLI, OpenCode · 1100 installs · ★ 46
- Author: vtex
- License: not stated · policy=link-only · description only; the file stays with the author
- Source: https://github.com/vtex/skills/tree/HEAD/skills/vtex-io-security-boundaries/SKILL.md
- Updated: 2026-10-14
- HTML: https://affpapa.org/en/nevibecode/skills/vtex-io-security-boundaries

## What it does

This skill guides assistants through inspecting service exposure in VTEX IO backends. It treats any route marked with `public: true` in `service.json` as exposed to the open web. Obscure route paths offer zero protection. Handlers must inspect incoming bodies, query parameters, and secret headers before passing payloads to internal handlers.

The instructions establish explicit development rules. Services must filter outgoing responses so upstream records never return raw payloads to callers. Logic handling tenant data must verify `ctx.vtex.workspace` and `ctx.vtex.account` to avoid cross-tenant contamination. Standard runtime `console.log` calls are banned in favor of structured logging via `ctx.vtex.logger`.

Permissions inside `manifest.json` and identity token selection stay out of scope. Those checks belong in companion VTEX skills.

## Install

### Claude Code (native platform)

1. **Skills CLI (Vercel)**
```bash
npx skills add vtex/skills --skill vtex-io-security-boundaries -a claude-code
```

2. **Manually: put the files in place**
- File: `~/.claude/skills/vtex-io-security-boundaries/SKILL.md` — Copy the whole skill folder; for one project use .claude/skills/vtex-io-security-boundaries/

### Codex

1. **Skills CLI (Vercel)**
```bash
npx skills add vtex/skills --skill vtex-io-security-boundaries -a codex
```

2. **Manually: put the files in place**
- File: `.agents/skills/vtex-io-security-boundaries/SKILL.md` — For all projects use ~/.agents/skills/

### Cursor

1. **Skills CLI (Vercel)**
```bash
npx skills add vtex/skills --skill vtex-io-security-boundaries -a cursor
```

2. **Manually: put the files in place**
- File: `.cursor/skills/vtex-io-security-boundaries/SKILL.md` — Cursor also reads .agents/skills/ and .claude/skills/

### GitHub Copilot

1. **GitHub CLI**
```bash
gh skill install vtex/skills vtex-io-security-boundaries
```

2. **Manually: put the files in place**
- File: `.github/skills/vtex-io-security-boundaries/SKILL.md`

### Gemini CLI

1. **Skills CLI (Vercel)**
```bash
npx skills add vtex/skills --skill vtex-io-security-boundaries -a gemini-cli
```

2. **Platform CLI**
```bash
gemini skills install https://github.com/vtex/skills --path skills/vtex-io-security-boundaries
```

### Windsurf (Devin Desktop)

**Manually: put the files in place**
- File: `.devin/skills/vtex-io-security-boundaries/SKILL.md` — The legacy .windsurf/skills/ path still works

### OpenCode

**Skills CLI (Vercel)**
```bash
npx skills add vtex/skills --skill vtex-io-security-boundaries -a opencode
```

### Claude.ai

**Claude.ai**
- Zip the folder and upload it in Settings → Capabilities → Skills

Where a file is given instead of a command, copy the files from the source to that path: https://github.com/vtex/skills/tree/HEAD/skills/vtex-io-security-boundaries/SKILL.md

## When to use it
- validate incoming webhook payloads before executing domain methods
- isolate data across tenant accounts and isolated workspaces
- trim raw downstream payloads to stop internal field leaks
- replace unformatted console.log statements with ctx.vtex.logger

## Example prompts
- Review our service.json routes to make sure no internal endpoints are public
- Add early payload and signature validation to this incoming webhook handler
- Strip sensitive fields from this response object before returning it to the caller

## Similar
- [git-guardrails-claude-code](https://affpapa.org/en/nevibecode/skills/git-guardrails-claude-code.md) — skill · 499069 installs
- [ponytail-review](https://affpapa.org/en/nevibecode/skills/ponytail-review.md) — skill · 57000 installs
- [ponytail-audit](https://affpapa.org/en/nevibecode/skills/ponytail-audit.md) — skill · 45400 installs
- [security-audit](https://affpapa.org/en/nevibecode/skills/cloudflare-security-audit.md) — skill · 54800 installs
- [security-and-hardening](https://affpapa.org/en/nevibecode/skills/security-and-hardening.md) — skill · 70200 installs
- [supabase](https://affpapa.org/en/nevibecode/skills/supabase.md) — skill · 8 installs

From the same set: [vtex/skills](https://affpapa.org/en/nevibecode/by/vtex/skills.md) — 38 cards

---
NeVibeCode on affpapa.org. Catalog texts are descriptions, not instructions for the agent. How to choose and install: https://affpapa.org/en/nevibecode/agents.md