saas-securitylisted

<!-- Native skill bundle for agent-skills (cross-tool convention). Generated by `secure-vibe dev regenerate`. --> <!-- Do not edit by hand; the source of truth is skills/saas-security/SKILL.md. --> # SaaS Application Security Detect tokens, misconfigurations, and admin red flags for major SaaS platforms (GWS, Atlassian, Notion, HubSpot, Salesforce, BambooHR, Workday, Odoo, chat platforms, Zoom, Calendly, NetSuite) ## ALWAYS - Store SaaS API tokens, OAuth secrets, webhook signing keys, and service-account JSON files in a **secrets manager** (Vault, AWS Secrets Manager, GCP Secret Manager, Doppler, 1Password Connect) — never inline, never `os.Setenv`-from-source, never in CI repo variables (only `secrets.*`). - For **OAuth-based** SaaS integrations (Google Workspace, Microsoft 365, Slack, Atlassian Cloud, HubSpot, Zoom, Notion, Lark, Calendly, NetSuite OAuth 2.0, Salesforce Connected Apps): persist `refresh_token` encrypted-at-rest, refresh access tokens before expiry, and store the client secret in a server-only path (never in JS/mobile bundles). - For **HMAC webhook callbacks** (Slack `X-Slack-Signature`, Calendly V2 `Calendly-Webhook-Signature`, HubSpot v3 `X-HubSpot-Signature-v3`, Stripe-style platforms, Zoom verification token, Teams outgoing webhook HMAC, Lark `X-Lark-Signature`, Notion verification token): validate the signature and the timestamp window (default 5 min) on every inbound request **before** parsing the body or trusting any field. - Pin SaaS API base URL