More screenshots

    Works with the AI tools you already use

    Claude CodeClaude CodeCursorCursorCodex CLICodex CLIGitHub CopilotGitHub CopilotGemini CLIGemini CLI+20 more

    SaaS Backend Code Reviewer

    1

    Production-grade backend code reviews focusing on security, multi-tenancy, and data integrity for SaaS systems.

    $6.99

    Secure checkout via Stripe

    30-day refund guarantee

    Converts to your local currency at checkout

    0 installsSecurity scanned
    SaaS Backend Code Reviewer

    SaaS Backend Code Reviewer

    Example session with this skill installed

    Review this Express.js endpoint for a multi-tenant SaaS. It handles organization-specific project updates: [pastes code with a missing tenant_id check in the update query].

    • Read your context and instructions
    • Compiled the saas backend code

    Mode: Full Production Review
    Summary: 1 Critical issue found. The endpoint lacks proper tenant isolation on the write path.
    1 Critical, 0 High, 0 Medium, 1 Low.

    Findings

    CRITICAL — Cross-tenant data overwrite in updateProject

    • Location: projects.controller.js line 42
    • Confidence: Confirmed — the db.update call uses where: { id } but lacks an org_id filter.

    Problem: A user from Org A can update a project belonging to Org B by guessing or brute-forcing the project UUID. In a multi-tenant SaaS, every query must be scoped to the authenticated tenant.

    • Suggested Fix:
    // Change this:
await db('projects').where({ id: req.params.id }).update(updateData);

// To this:
await db('projects')
  .where({ 
    id: req.params.id, 
    org_id: req.user.org_id  // Scope to the authenticated user's organization
  })
  .update(updateData);

    LOW — Missing Input Validation for updateData

    • Location: projects.controller.js line 38
    • Confidence: High — req.body is passed directly to the database update without a schema check.

    Problem: Potential mass assignment risk. If the projects table has internal fields like is_premium or plan_level, a malicious user could potentially update those via the request body.

    Suggested Fix: Use a schema validator like Joi or Zod to allowlist only permitted fields (e.g., name, description).

    Nitpicks

    • Standardize HTTP 204 No Content for successful updates instead of 200 OK with an empty body.

    What wasn't reviewed

    • Observability: No logging middleware was shown in this snippet.
    • Dependency risk: Version of knex / pg is unknown.

    Next steps

    • Apply the org_id filter to the update query immediately.
    • Implement a validation schema for the request body.
    • Verify that the GET and DELETE endpoints for this resource also enforce the org_id filter.

    Connects securely to your tools. The creator never sees your data.

    What you get

    Verify tenant isolation in multi-tenant database queries.Detect race conditions and missing transactions in complex write operations.Audit API endpoints for security vulnerabilities and injection risks.Identify N+1 query patterns and performance bottlenecks in backend services.

    About this skill

    SaaS backend code can hide serious production risks that are easy to miss during a conventional code review. Tenant data leaks, race conditions, broken idempotency, and architectural weaknesses can lead to security incidents, corrupted data, or unexpected outages.

    This skill performs rigorous audits across eight dimensions, including security, multi-tenancy isolation, concurrency, data integrity, performance, API design, observability, and testing.

    Each finding receives independent Severity and Confidence ratings, helping distinguish confirmed issues from suspicious patterns that require further investigation.

    Choose focused review modes such as Security, Performance, or PR/Diff when you need targeted feedback without unnecessary noise.

    The skill follows a strict "never fabricate" principle. Findings are tied to specific code whenever possible, and missing context is explicitly acknowledged instead of being presented as fact.

    Unlike generic AI code reviews, it follows a disciplined engineering rubric designed to reduce false positives, avoid generic style nitpicks, and focus attention on issues that can actually affect a SaaS application in production.

    Use cases

    • Review a new API endpoint before merging it into production. • Audit a multi-tenant data access layer for tenant isolation issues. • Investigate potential race conditions or idempotency problems in webhook handlers. • Perform security-focused reviews of authentication and token-handling logic. • Evaluate backend changes in a pull request or code diff.

    Known limitations

    Infrastructure-level security controls such as WAF and IAM cannot be verified unless their configuration is explicitly provided. Specific package vulnerabilities or version-related issues also cannot be confirmed without the relevant dependency information.

    How to install

    Works the same in every agent - Claude, Cursor, Codex, Copilot and 20+ more.

    ~30 seconds
    1. 1

      Download the ZIP

      Free skills download straight away. Paid skills unlock right after purchase.

    2. 2

      Unzip into your skills folder

      Every agent reads skills from one folder on your machine. Drop the unzipped folder in there.

    3. 3

      Ask your agent to use it

      Restart the agent if it was already running. It picks the skill up automatically - no config needed.

    Skills folder by agent

    Click the path to copy it. Create the folder if it does not exist yet.

    Reviews

    No reviews yet

    Be one of the first to try it. Every listed skill passes our trust checks below.

    Security scanned

    Passed our 8-point scan before listing

    Fresh listing

    Recently published to Agensi

    30-day refund

    Not a fit? Get your money back

    Trust & safety

    Security scanned

    Verified clean today

    • Passed all security checks, Safe to install

    Listedtoday

    Frequently Asked Questions