vibes-plug 1.0.0

package/skills/saas-transformer/scripts/saas_transformation_scanner.py

@@ -0,0 +1,254 @@
+#!/usr/bin/env python3
+"""
+SaaS Transformation Scanner
+Automated scanner that runs a SaaS transformation readiness audit against a target project.
+"""
+
+import os
+import sys
+import json
+import argparse
+import re
+from pathlib import Path
+from typing import Dict, List
+
+
+class SaasTransformationScanner:
+    """Scans an existing codebase for SaaS transformation readiness across 8 pillars."""
+
+    PILLAR_WEIGHTS = {
+        'tenancy': 0.20,
+        'auth': 0.15,
+        'billing': 0.20,
+        'teams': 0.15,
+        'frontend': 0.10,
+        'api': 0.10,
+        'hardening': 0.10,
+    }
+
+    def __init__(self, target_path: str, verbose: bool = False):
+        self.target_path = Path(target_path)
+        self.verbose = verbose
+        self.pillars: Dict[str, Dict] = {}
+        self.overall_score = 0
+
+    def run(self) -> Dict:
+        """Execute the full SaaS transformation readiness scan."""
+        print("🚀 SaaS Transformation Scanner")
+        print(f"📁 Target Project: {self.target_path}")
+        print("=" * 60)
+
+        if not self.target_path.exists():
+            print(f"❌ Target path does not exist: {self.target_path}")
+            sys.exit(1)
+
+        # Run audits
+        self._audit_tenancy()
+        self._audit_auth()
+        self._audit_billing()
+        self._audit_teams()
+        self._audit_frontend()
+        self._audit_api()
+        self._audit_hardening()
+
+        # Calculate score and report
+        self._calculate_overall_score()
+        self._generate_report()
+
+        return {
+            'target': str(self.target_path),
+            'overall_score': self.overall_score,
+            'pillars': self.pillars,
+        }
+
+    def _init_pillar(self, name: str, display_name: str) -> Dict:
+        """Initialize a pillar result structure."""
+        pillar = {
+            'name': display_name,
+            'score': 100,
+            'checks': [],
+            'critical': 0,
+            'warnings': 0,
+            'passed': 0,
+        }
+        self.pillars[name] = pillar
+        if self.verbose:
+            print(f"\n📋 Pillar: {display_name}")
+            print("-" * 40)
+        return pillar
+
+    def _check(self, pillar: Dict, name: str, passed: bool, severity: str = 'warning', penalty: int = 15):
+        """Record check result and adjust scores."""
+        pillar['checks'].append({
+            'name': name,
+            'passed': passed,
+            'severity': severity,
+        })
+        if passed:
+            pillar['passed'] += 1
+            if self.verbose:
+                print(f"  ✅ {name}")
+        else:
+            if severity == 'critical':
+                pillar['critical'] += 1
+                pillar['score'] -= max(penalty, 25)
+            else:
+                pillar['warnings'] += 1
+                pillar['score'] -= penalty
+            pillar['score'] = max(0, pillar['score'])
+            icon = '🔴' if severity == 'critical' else '🟡'
+            if self.verbose:
+                print(f"  {icon} {name}")
+
+    def _file_exists(self, *paths: str) -> bool:
+        return any((self.target_path / p).exists() for p in paths)
+
+    def _dir_exists(self, *paths: str) -> bool:
+        return any((self.target_path / p).is_dir() for p in paths)
+
+    def _grep_project(self, pattern: str, extensions: List[str] = None) -> List[str]:
+        matches = []
+        exts = extensions or ['.ts', '.tsx', '.js', '.jsx', '.py', '.go', '.rs', '.prisma']
+        for ext in exts:
+            for f in self.target_path.rglob(f'*{ext}'):
+                if any(x in str(f) for x in ['node_modules', '.next', 'dist', '.git']):
+                    continue
+                try:
+                    content = f.read_text(errors='ignore')
+                    if re.search(pattern, content):
+                        matches.append(str(f.relative_to(self.target_path)))
+                except (IOError, OSError):
+                    continue
+        return matches
+
+    def _audit_tenancy(self):
+        p = self._init_pillar('tenancy', 'Multi-Tenancy Foundation')
+        
+        # Check database schema structure
+        has_db_schema = self._file_exists('prisma/schema.prisma') or self._grep_project('pgTable|sqliteTable|mysqlTable', ['.ts', '.js'])
+        self._check(p, 'Database schema config exists', has_db_schema, severity='critical')
+
+        # Check tenant id usage
+        tenant_cols = self._grep_project(r'tenant_id|tenantId|workspace_id|workspaceId', ['.prisma', '.ts', '.js'])
+        self._check(p, 'tenant_id/workspace_id column configured in models', len(tenant_cols) > 0, severity='critical')
+
+        # Check RLS
+        has_rls = self._grep_project(r'ROW LEVEL SECURITY|ENABLE RLS|enableRowLevelSecurity', ['.sql', '.ts', '.js'])
+        self._check(p, 'PostgreSQL RLS setup or database policies present', len(has_rls) > 0)
+
+        # Check Tenant Middleware
+        has_mw = self._grep_project(r'tenantMiddleware|app\.current_tenant_id|tenantContext', ['.ts', '.js', '.py', '.go'])
+        self._check(p, 'Tenant-aware middleware initialized', len(has_mw) > 0)
+
+    def _audit_auth(self):
+        p = self._init_pillar('auth', 'Authentication & Authorization')
+
+        # Auth service provider detection
+        has_clerk = self._grep_project(r'clerkMiddleware|@clerk/nextjs', ['.ts', '.tsx', '.json'])
+        has_nextauth = self._grep_project(r'NextAuth|auth\.js', ['.ts', '.js'])
+        has_supabase_auth = self._grep_project(r'supabase\.auth|@supabase/ssr', ['.ts', '.tsx', '.js'])
+        self._check(p, 'Production auth provider configured (Clerk/NextAuth/Supabase Auth)', 
+                    bool(has_clerk or has_nextauth or has_supabase_auth), severity='critical')
+
+        # Roles / RBAC
+        has_roles = self._grep_project(r'role\s*:\s*["\'](admin|owner|member)["\']|requireRole|checkPermission', ['.ts', '.tsx', '.js', '.py'])
+        self._check(p, 'Role-Based Access Control (RBAC) definitions exist', len(has_roles) > 0)
+
+    def _audit_billing(self):
+        p = self._init_pillar('billing', 'Billing & Subscription')
+
+        # Payment Provider dependencies
+        has_stripe = self._grep_project(r'stripe|lemonsqueezy|paddle-sdk', ['.json', '.ts', '.js', '.py'])
+        self._check(p, 'Payment processor integrated (Stripe/LemonSqueezy)', len(has_stripe) > 0, severity='critical')
+
+        # Webhooks
+        has_webhook = self._grep_project(r'stripe\.webhooks|constructEvent|webhooks/stripe', ['.ts', '.js', '.py'])
+        self._check(p, 'Webhook listener for payment events implemented', len(has_webhook) > 0)
+
+        # Pricing and Plans config
+        has_pricing = self._grep_project(r'pricing|plans|subscriptionStatus|tier', ['.ts', '.tsx', '.js'])
+        self._check(p, 'Pricing plan definitions present', len(has_pricing) > 0)
+
+    def _audit_teams(self):
+        p = self._init_pillar('teams', 'Workspace & Team Management')
+
+        # Member list / Workspace switcher check
+        has_switcher = self._grep_project(r'workspaceSwitcher|WorkspaceSelect|switchWorkspace', ['.tsx', '.ts', '.js'])
+        self._check(p, 'Workspace switching controls found', len(has_switcher) > 0)
+
+        # Invite flow
+        has_invites = self._grep_project(r'workspace_invitations|inviteMember|invitationToken', ['.prisma', '.ts', '.js'])
+        self._check(p, 'Team invitation system models or methods exist', len(has_invites) > 0)
+
+    def _audit_frontend(self):
+        p = self._init_pillar('frontend', 'SaaS App Shell & Dashboard')
+
+        # Shell and settings pages
+        has_billing_ui = self._grep_project(r'/settings/billing|BillingSettings', ['.tsx', '.ts', '.js'])
+        self._check(p, 'Billing/subscription settings page implemented', len(has_billing_ui) > 0)
+
+        has_team_ui = self._grep_project(r'/settings/team|TeamSettings', ['.tsx', '.ts', '.js'])
+        self._check(p, 'Team/member settings page implemented', len(has_team_ui) > 0)
+
+    def _audit_api(self):
+        p = self._init_pillar('api', 'API Layer & Feature Gating')
+
+        # Gated flags or plan limits
+        has_gating = self._grep_project(r'PLAN_LIMITS|PLAN_CONFIGS|hasFeature|assertHasFeature', ['.ts', '.tsx', '.js'])
+        self._check(p, 'Feature gating / usage limit configuration map defined', len(has_gating) > 0)
+
+        # Usage metering log
+        has_metering = self._grep_project(r'usage_records|usageRecords|usageMeter|incrementUsage', ['.prisma', '.ts', '.js'])
+        self._check(p, 'Usage metering / metric tracking database model exists', len(has_metering) > 0)
+
+    def _audit_hardening(self):
+        p = self._init_pillar('hardening', 'Production Hardening')
+
+        # Basic rate limits
+        has_rate_limit = self._grep_project(r'rate.?limit|upstash/ratelimit|limiter', ['.ts', '.js', '.py'])
+        self._check(p, 'API Rate Limiting setup configured', len(has_rate_limit) > 0)
+
+        # Env validation
+        has_env_spec = self._file_exists('.env.example', '.env.template')
+        self._check(p, 'Environment example schema exists', has_env_spec)
+
+    def _calculate_overall_score(self):
+        total = 0
+        for pillar_key, weight in self.PILLAR_WEIGHTS.items():
+            if pillar_key in self.pillars:
+                total += self.pillars[pillar_key]['score'] * weight
+        self.overall_score = round(total)
+
+    def _get_grade(self, score: int) -> str:
+        if score >= 90:
+            return 'A'
+        elif score >= 80:
+            return 'B'
+        elif score >= 70:
+            return 'C'
+        elif score >= 60:
+            return 'D'
+        return 'F'
+
+    def _generate_report(self):
+        grade = self._get_grade(self.overall_score)
+        print(f"\n🎯 Overall SaaS Readiness: {self.overall_score}/100 ({grade})")
+        print("-" * 60)
+        
+        for k, p in self.pillars.items():
+            icon = '✅' if p['score'] >= 85 else ('🟡' if p['score'] >= 50 else '🔴')
+            print(f"  {icon} {p['name']:<30} {p['score']:>4}/100 (Crit: {p['critical']}, Warn: {p['warnings']})")
+
+
+def main():
+    parser = argparse.ArgumentParser(description="SaaS Transformation Scanner")
+    parser.add_argument('target', help='Path of project to audit')
+    parser.add_argument('--verbose', '-v', action='store_true', help='Show check details')
+    args = parser.parse_args()
+
+    scanner = SaasTransformationScanner(args.target, verbose=args.verbose)
+    scanner.run()
+
+
+if __name__ == '__main__':
+    main()

package/skills/scalability-clean-code/SKILL.md

@@ -0,0 +1,229 @@
+---
+name: scalability-clean-code
+description: "Software architecture guidelines to maintain code readability (Clean Code, SOLID, DRY) and application scalability / Panduan arsitektur perangkat lunak untuk menjaga keterbacaan kode (Clean Code, SOLID, DRY) dan kemampuan skalabilitas aplikasi."
+author: "Roedy Rustam"
+---
+
+# Scalability & Clean Code (2026 Edition)
+
+[English](#english) | [Bahasa Indonesia](#bahasa-indonesia)
+
+---
+
+<a name="english"></a>
+## English
+
+### Description
+Software architecture guidelines for writing clean, scalable, and maintainable code. Covers SOLID principles, DRY/YAGNI/KISS, Clean Architecture layers, **Vertical Slice Architecture** (the modern alternative to layered architecture), Domain-Driven Design (DDD) patterns, and practical refactoring techniques.
+
+### Trigger Conditions
+- Refactoring a codebase that has become hard to understand or modify.
+- Designing the architecture for a new feature or service.
+- Identifying and eliminating code smells (God Classes, Feature Envy, Long Methods).
+- Deciding between Layered Architecture vs Vertical Slice Architecture.
+- Applying SOLID principles to a specific code problem.
+
+### The SOLID Principles (With Modern Context)
+
+#### Single Responsibility Principle (SRP)
+A module/class/function should have one reason to change. In 2026 React/Node.js context:
+- **Bad**: A React component that fetches data, transforms it, and renders UI.
+- **Good**: Separate `useUserQuery()` hook (fetch), `transformUser()` util (transform), `UserCard` component (render).
+
+#### Open/Closed Principle (OCP)
+Open for extension, closed for modification. Use composition and strategy pattern:
+```typescript
+// Bad: modify existing code every time a new payment provider is added
+function processPayment(type: 'stripe' | 'polar' | 'paypal', amount: number) {
+  if (type === 'stripe') { /* ... */ }
+  else if (type === 'polar') { /* ... */ }
+}
+
+// Good: extend by adding new providers, not modifying existing code
+interface PaymentProvider {
+  charge(amount: number): Promise<Receipt>;
+}
+
+class StripeProvider implements PaymentProvider { ... }
+class PolarProvider implements PaymentProvider { ... }
+
+function processPayment(provider: PaymentProvider, amount: number) {
+  return provider.charge(amount);
+}
+```
+
+#### Dependency Inversion Principle (DIP)
+High-level modules should not depend on low-level modules — both should depend on abstractions:
+```typescript
+// Bad: handler directly imports concrete DB client
+import { db } from './postgres-client';
+
+// Good: inject the repository interface
+interface UserRepository {
+  findById(id: string): Promise<User | null>;
+  save(user: User): Promise<void>;
+}
+
+async function getUser(repo: UserRepository, id: string) {
+  return repo.findById(id);
+}
+```
+
+### Vertical Slice Architecture (VSA)
+The modern alternative to traditional layered architecture (Controller → Service → Repository). Organize code by **feature** (vertical slice) rather than by **technical layer** (horizontal slice):
+
+```
+Traditional (Layered):
+src/
+  controllers/    ← all controllers together
+  services/       ← all services together
+  repositories/   ← all repositories together
+
+Vertical Slice:
+src/
+  features/
+    users/
+      create-user.handler.ts    ← all logic for "create user" in one place
+      create-user.schema.ts
+      create-user.test.ts
+    products/
+      list-products.handler.ts
+      list-products.schema.ts
+```
+
+**Benefits of VSA**:
+- Features are self-contained — easy to add, modify, delete, or move.
+- No need to navigate 3-4 layers just to trace one user story.
+- Natural boundary for microservice extraction.
+
+```typescript
+// features/users/create-user.handler.ts
+// One file contains the complete "create user" vertical slice
+import { z } from 'zod';
+import { db } from '@/lib/db';
+import { sendWelcomeEmail } from '@/lib/email';
+
+export const CreateUserSchema = z.object({
+  name: z.string().min(2),
+  email: z.string().email(),
+});
+
+export type CreateUserInput = z.infer<typeof CreateUserSchema>;
+
+export async function handleCreateUser(input: CreateUserInput) {
+  const validated = CreateUserSchema.parse(input);
+  
+  const user = await db.user.create({ data: validated });
+  await sendWelcomeEmail(user.email, user.name);
+  
+  return user;
+}
+```
+
+### Clean Code Principles
+
+#### Functions
+- **Do one thing**: Functions should do one thing and do it well.
+- **Small**: Aim for < 20 lines. If longer, extract sub-functions.
+- **Descriptive names**: `getUsersByWorkspace()` not `getData()`.
+- **No side effects**: Pure functions are predictable and testable.
+
+#### Naming
+- Variables: noun phrases (`userCount`, `activeWorkspaces`).
+- Functions: verb phrases (`fetchUser`, `validateInput`, `sendEmail`).
+- Boolean: question form (`isActive`, `hasPermission`, `canEdit`).
+- Avoid abbreviations: `workspace` not `ws`, `configuration` not `cfg`.
+
+#### Comments
+- **Don't comment bad code — rewrite it.**
+- Write self-documenting code: well-named variables and functions eliminate the need for most comments.
+- **Do** comment: why (intent), not what (obvious from code).
+
+#### DRY, YAGNI, KISS
+- **DRY**: Don't Repeat Yourself — extract shared logic. But: avoid premature abstraction.
+- **YAGNI**: You Aren't Gonna Need It — don't build features "just in case".
+- **KISS**: Keep It Simple, Stupid — the simplest solution that works is usually best.
+
+### Code Smells & Refactoring
+
+| Smell | Symptom | Refactoring |
+|---|---|---|
+| **God Class** | Class does everything | Extract Class, Move Method |
+| **Long Method** | Method > 30 lines | Extract Method |
+| **Feature Envy** | Method uses another class's data excessively | Move Method |
+| **Data Clumps** | Same 3+ params appear together repeatedly | Introduce Parameter Object |
+| **Magic Numbers** | `if (status === 3)` | Extract Constant |
+| **Shotgun Surgery** | One change requires edits in many places | Move Method, Inline Class |
+| **Primitive Obsession** | Using string/int for domain concepts | Replace with Value Object |
+
+### Architecture Decision Framework
+When choosing an architecture, ask:
+1. **What changes together?** Organize code that changes together.
+2. **What is independently deployable?** Separate services by deployment boundary.
+3. **What has different scaling needs?** Scale independently only what needs it.
+4. **What is the team size?** Microservices add overhead — start monolith, extract when needed.
+
+---
+
+<a name="bahasa-indonesia"></a>
+## Bahasa Indonesia
+
+### Deskripsi
+Panduan arsitektur perangkat lunak untuk menulis kode yang bersih, skalabel, dan mudah dirawat. Mencakup prinsip SOLID, DRY/YAGNI/KISS, lapisan Clean Architecture, **Vertical Slice Architecture** (alternatif modern dari layered architecture), pola Domain-Driven Design (DDD), dan teknik refactoring praktis.
+
+### Kondisi Pemicu
+- Merefaktor codebase yang sulit dipahami atau dimodifikasi.
+- Merancang arsitektur untuk fitur atau layanan baru.
+- Mengidentifikasi dan menghilangkan code smell (God Class, Feature Envy, Long Method).
+- Memutuskan antara Layered Architecture vs Vertical Slice Architecture.
+- Menerapkan prinsip SOLID pada masalah kode tertentu.
+
+### Prinsip SOLID
+
+#### SRP — Single Responsibility Principle
+Setiap modul/kelas/fungsi harus memiliki satu alasan untuk berubah. Pisahkan pengambilan data, transformasi data, dan rendering UI.
+
+#### OCP — Open/Closed Principle
+Terbuka untuk ekstensi, tertutup untuk modifikasi. Gunakan komposisi dan pola strategi — tambah provider baru tanpa mengubah kode yang ada.
+
+#### DIP — Dependency Inversion Principle
+Modul tingkat tinggi tidak boleh bergantung pada modul tingkat rendah — keduanya harus bergantung pada abstraksi (interface).
+
+### Vertical Slice Architecture (VSA)
+Alternatif modern dari layered architecture tradisional. Organisasikan kode berdasarkan **fitur** (irisan vertikal), bukan lapisan teknis (irisan horizontal).
+
+**Keuntungan VSA:**
+- Fitur bersifat self-contained — mudah ditambah, dimodifikasi, dihapus, atau dipindah.
+- Tidak perlu menavigasi 3-4 layer hanya untuk melacak satu user story.
+- Batas natural untuk ekstraksi microservice.
+
+### Prinsip Clean Code
+
+#### Fungsi
+- Lakukan satu hal dan lakukan dengan baik.
+- Nama deskriptif: `getUsersByWorkspace()` bukan `getData()`.
+- Tanpa efek samping: fungsi murni dapat diprediksi dan diuji.
+
+#### Penamaan
+- Variabel: frasa kata benda (`jumlahPengguna`, `workspaceAktif`).
+- Fungsi: frasa kata kerja (`ambilPengguna`, `validasiInput`).
+- Boolean: bentuk pertanyaan (`aktif`, `punyaIzin`, `bisaEdit`).
+
+#### Komentar
+- Jangan komen kode buruk — tulis ulang.
+- Tulis kode yang mendokumentasikan dirinya sendiri.
+- Komentar: **mengapa** (niat), bukan apa (jelas dari kode).
+
+#### DRY, YAGNI, KISS
+- **DRY**: Jangan ulangi diri sendiri — ekstrak logika bersama.
+- **YAGNI**: Anda tidak akan membutuhkannya — jangan bangun fitur "untuk jaga-jaga".
+- **KISS**: Tetap sederhana — solusi paling sederhana yang berfungsi biasanya terbaik.
+
+### Code Smell & Refactoring
+Identifikasi dan perbaiki: God Class, Long Method, Feature Envy, Data Clumps, Magic Numbers, Shotgun Surgery, Primitive Obsession.
+
+### Framework Keputusan Arsitektur
+1. **Apa yang berubah bersama?** Organisasikan kode yang berubah bersama.
+2. **Apa yang dapat di-deploy secara independen?** Pisahkan layanan berdasarkan batas deployment.
+3. **Apa yang memiliki kebutuhan scaling berbeda?** Scale secara independen hanya yang membutuhkannya.
+4. **Berapa besar tim?** Microservices menambah overhead — mulai monolith, ekstrak saat diperlukan.

package/skills/secure-fuzz-testing/SKILL.md

@@ -0,0 +1,201 @@
+---
+name: secure-fuzz-testing
+description: "Expert-level skill for writing and integrating coverage-guided fuzz tests in Python, Rust, and Go for secure code validation in English and Indonesian."
+author: "Roedy Rustam"
+---
+
+# Secure Fuzz Testing
+
+[English](#english) | [Bahasa Indonesia](#bahasa-indonesia)
+
+---
+
+<a name="english"></a>
+## English
+
+### Description
+Expert-level guidance for writing, running, and integrating coverage-guided fuzz tests (fuzzing) to identify security vulnerabilities, memory leaks, and input-validation issues in software applications. This skill covers writing fuzz targets in **Python**, **Rust**, and **Go**, configuring compilers with sanitizers (ASan, MSan, UBSan), and setting up automated CI/CD security pipelines.
+
+### Trigger Conditions
+- Use when designing or reviewing data parsers, serialization/deserialization logic, or file formats.
+- Use when writing libraries that process untrusted network input or binary data streams.
+- Use when integrating automated security testing into a DevSecOps pipeline (CI/CD).
+- Use when troubleshooting complex memory bugs, edge-case crashes, or unhandled exceptions.
+
+### Writing Fuzz Targets
+Coverage-guided fuzzers need a target function that accepts a stream of bytes and processes it.
+
+#### 1. Python Fuzzing (Atheris)
+`Atheris` is a coverage-guided fuzzer for Python. It can fuzz Python code and native extensions:
+```python
+import sys
+import atheris
+
+with atheris.instrument_imports():
+    import our_parser  # Import target module inside instrument_imports
+
+def TestOneInput(data):
+    if len(data) < 4:
+        return
+    try:
+        # Decode and parse the byte data
+        text = data.decode("utf-8", errors="ignore")
+        our_parser.parse_config(text)
+    except our_parser.ParseException:
+        # Expected exceptions should be caught to avoid false positives
+        pass
+
+atheris.Setup(sys.argv, TestOneInput)
+atheris.Fuzz()
+```
+
+#### 2. Rust Fuzzing (cargo-fuzz & libFuzzer)
+Rust has first-class fuzzing support via `cargo-fuzz` which wraps `libFuzzer`:
+```rust
+#![no_main]
+use libfuzzer_sys::fuzz_target;
+
+fuzz_target!(|data: &[u8]| {
+    if let Ok(input_str) = std::str::from_utf8(data) {
+        let _ = our_crate::parse_config(input_str);
+    }
+});
+```
+- **Run Fuzzer**: Execute `cargo +nightly fuzz run <target_name>`.
+
+#### 3. Go Fuzzing (Native Go Fuzz)
+Go supports native fuzzing in its standard library (`testing` package):
+```go
+package main
+
+import (
+	"testing"
+	"ourmodule/parser"
+)
+
+func FuzzParseConfig(f *testing.F) {
+	// Add seed corpus for initial coverage guidance
+	f.Add([]byte("config_key = value"))
+	
+	f.Fuzz(func(t *testing.T, data []byte) {
+		_, err := parser.ParseConfig(data)
+		if err != nil {
+			t.Skip() // Skip expected/graceful errors
+		}
+	})
+}
+```
+- **Run Fuzzer**: Run `go test -fuzz=FuzzParseConfig -fuzztime=10m`.
+
+### Diagnostics & Sanitizers
+Use compiler instrumentation flags to expose hidden bugs:
+- **AddressSanitizer (ASan)**: Detects out-of-bounds access, use-after-free, and memory leaks.
+- **UndefinedBehaviorSanitizer (UBSan)**: Detects integer overflows, alignment issues, and division by zero.
+- **ThreadSanitizer (TSan)**: Finds data races in multithreaded environments.
+
+### DevSecOps & CI Integration
+- **OSS-Fuzz**: For open-source projects, integrate with Google's OSS-Fuzz for continuous fuzzing infrastructure.
+- **GitHub Actions**: Run fuzz targets on pull requests with short run times (`fuzztime=5m`) to catch regression errors without blocking pipelines.
+
+---
+
+### Troubleshooting & Common Gotchas
+- **False Positives**: Ensure expected API errors and clean validation errors do not cause the fuzzer to abort. Catch expected exceptions or use `t.Skip()` where appropriate.
+- **State Pollution**: Fuzz targets must be stateless. Avoid sharing mutable global states between iterations.
+- **Infinite Loops**: Guard against code that hangs. Configure timeouts (`-timeout=25` in libFuzzer) to automatically crash long-running executions.
+
+---
+
+<a name="bahasa-indonesia"></a>
+## Bahasa Indonesia
+
+### Deskripsi
+Panduan tingkat ahli untuk menulis, menjalankan, dan mengintegrasikan pengujian berbasis cakupan (*coverage-guided fuzzing*) untuk mengidentifikasi celah keamanan, kebocoran memori, dan kesalahan validasi input dalam aplikasi perangkat lunak. Skill ini mencakup penulisan target fuzzing dalam bahasa **Python**, **Rust**, dan **Go**, konfigurasi compiler dengan sanitizer (ASan, MSan, UBSan), serta penyiapan pipa otomatisasi keamanan CI/CD.
+
+### Kondisi Pemicu
+- Gunakan saat merancang atau memeriksa parser data, logika serialisasi/deserialisasi, atau pemroses format berkas.
+- Gunakan saat menulis pustaka (*library*) yang memproses input jaringan yang tidak tepercaya atau aliran data biner.
+- Gunakan saat mengintegrasikan pengujian keamanan otomatis ke dalam alur kerja DevSecOps (CI/CD).
+- Gunakan saat mendiagnosis bug memori yang kompleks, crash pada kasus ekstrem (*edge-cases*), atau *exception* yang tidak ditangani.
+
+### Penulisan Target Fuzzing
+Fuzzer berbasis cakupan memerlukan fungsi target yang menerima aliran byte untuk kemudian diproses secara dinamis.
+
+#### 1. Fuzzing Python (Atheris)
+`Atheris` adalah fuzzer berbasis cakupan untuk kode Python dan ekstensi native (C/C++):
+```python
+import sys
+import atheris
+
+with atheris.instrument_imports():
+    import our_parser  # Impor modul target di dalam instrument_imports
+
+def TestOneInput(data):
+    if len(data) < 4:
+        return
+    try:
+        # Dekode data byte menjadi teks
+        text = data.decode("utf-8", errors="ignore")
+        our_parser.parse_config(text)
+    except our_parser.ParseException:
+        # Tangkap exception yang diharapkan agar tidak dianggap crash palsu
+        pass
+
+atheris.Setup(sys.argv, TestOneInput)
+atheris.Fuzz()
+```
+
+#### 2. Fuzzing Rust (cargo-fuzz & libFuzzer)
+Rust memiliki dukungan fuzzing kelas satu melalui utilitas `cargo-fuzz` yang menggunakan pustaka `libFuzzer`:
+```rust
+#![no_main]
+use libfuzzer_sys::fuzz_target;
+
+fuzz_target!(|data: &[u8]| {
+    if let Ok(input_str) = std::str::from_utf8(data) {
+        let _ = our_crate::parse_config(input_str);
+    }
+});
+```
+- **Jalankan Fuzzer**: Eksekusi perintah `cargo +nightly fuzz run <nama_target>`.
+
+#### 3. Fuzzing Go (Native Go Fuzz)
+Go mendukung pengujian fuzzing secara native dalam pustaka standarnya (`testing` package):
+```go
+package main
+
+import (
+	"testing"
+	"ourmodule/parser"
+)
+
+func FuzzParseConfig(f *testing.F) {
+	// Tambahkan seed corpus awal sebagai panduan awal cakupan fuzzer
+	f.Add([]byte("config_key = value"))
+	
+	f.Fuzz(func(t *testing.T, data []byte) {
+		_, err := parser.ParseConfig(data)
+		if err != nil {
+			t.Skip() // Lewati error yang memang diharapkan (ditangani dengan aman)
+		}
+	})
+}
+```
+- **Jalankan Fuzzer**: Eksekusi perintah `go test -fuzz=FuzzParseConfig -fuzztime=10m`.
+
+### Diagnosis & Sanitizer
+Gunakan tanda instrumentasi kompiler untuk mendeteksi bug tersembunyi secara dini:
+- **AddressSanitizer (ASan)**: Mendeteksi akses memori di luar batas (*out-of-bounds*), penggunaan setelah dibebaskan (*use-after-free*), dan kebocoran memori (*memory leak*).
+- **UndefinedBehaviorSanitizer (UBSan)**: Mendeteksi overflow integer, masalah penyelarasan memori (*alignment*), dan pembagian dengan nol.
+- **ThreadSanitizer (TSan)**: Menemukan perebutan data (*data race*) pada eksekusi multithread.
+
+### Integrasi DevSecOps & CI
+- **OSS-Fuzz**: Untuk proyek open-source, integrasikan dengan platform OSS-Fuzz dari Google untuk pemantauan berkelanjutan.
+- **GitHub Actions**: Jalankan target fuzzing pada pull request dengan batasan waktu yang singkat (`fuzztime=5m`) untuk menangkap regresi kode tanpa menghambat alur build.
+
+---
+
+### Pemecahan Masalah & Kesalahan Umum
+- **Crash Palsu (False Positives)**: Pastikan error API yang ditangani dengan aman tidak membuat fuzzer berhenti. Tangkap exception tersebut atau gunakan `t.Skip()` pada Go.
+- **Polusi State (State Pollution)**: Pastikan target fuzzing bersifat stateless. Jangan biarkan state global mutable dibagikan antar iterasi pengujian.
+- **Loop Tak Terbatas**: Waspadai kode yang mengalami hang. Konfigurasikan batas waktu (`-timeout=25` pada libFuzzer) agar eksekusi yang macet secara otomatis dilaporkan sebagai crash.