markpyvo

App Lockdown — Development skill for Claude Code

Development community

Claude skill that audits your app for the 15 most common ways apps get hacked, then fixes each one with a diff you approve.

How to install App Lockdown

This entry records only its repository, not the path inside it, so there is no exact command to give. Open markpyvo/app-lockdown and copy the folder into ~/.claude/skills/, or the file into ~/.claude/agents/.

What App Lockdown does

Claude skill that audits your app for the 15 most common ways apps get hacked, then fixes each one with a diff you approve.

Alternatives in Development

Troubleshooting Guide — Common issues and solutions when using Skill Seeker 12.9k ★
Native Feel Skill — An Agent Skill for designing cross-platform desktop apps that feel native — distilled from Raycast's 2.0 deep 1.9k ★
Projectmem — Open-source coding agent memory 766 ★

README

app-lockdown

**Your AI built the app. This makes sure it can't be hacked in an afternoon.**

![license](https://img.shields.io/badge/license-MIT-green) ![type](https://img.shields.io/badge/Claude-skill-orange) ![checks](https://img.shields.io/badge/checks-15-blue) ![cost](https://img.shields.io/badge/price-free-brightgreen)

A Claude skill that audits your app for the 15 most common ways apps get hacked, hands you a plain-English report, and fixes each issue with a diff you approve.

AI tools are great at building apps and bad at securing them. Tell one to "make it secure" and it usually moves your API key into a `.env` file and calls it done, while the upload endpoint takes any file, the payment webhook trusts anyone, and user comments render as raw HTML. This skill goes after the stuff that actually gets apps breached.

60 second start

git clone https://github.com/markpyvo/app-lockdown ~/.claude/skills/app-lockdown

Then open Claude in your project and say:

Run app-lockdown on this project

That's it. You get a report, then fixes one diff at a time.

Not using Claude Code? See [Install](#install) for the Claude app.

What it does

Scans your project: a fast pattern sweep, then Claude reads the code that matters (routes, auth, schema, webhooks, uploads).
Reports what it found in LOCKDOWN_REPORT.md, ranked Critical to Low, with file and line numbers and plain-English explanations.
Fixes each issue one diff at a time. Nothing changes until you approve it.
Re-scans to confirm the fixes held, and lists any manual steps (like rotating a key) that code can't do for you.

What a finding looks like

### [LOCK-002] Stripe webhook accepts anyone: Critical
- Check:   2. Payment webhook verification
- Where:   app/api/stripe/webhook/route.ts:14
- What's wrong:  The endpoint marks orders as paid without checking
                 the request really came from Stripe.
- What an attacker can do:  Send a fake "payment suc