vibes-plug 1.0.0

package/skills/api-design-expert/SKILL.md

@@ -0,0 +1,310 @@
+---
+name: api-design-expert
+description: "Expert guide for designing robust APIs: REST best practices, GraphQL, gRPC, tRPC, OpenAPI/Swagger, API versioning, rate limiting, and contract-first design / Panduan ahli untuk merancang API yang kuat: praktik terbaik REST, GraphQL, gRPC, tRPC, OpenAPI/Swagger, versioning API, rate limiting, dan desain contract-first."
+author: "Roedy Rustam"
+---
+
+# API Design Expert
+
+[English](#english) | [Bahasa Indonesia](#bahasa-indonesia)
+
+---
+
+<a name="english"></a>
+## English
+
+### Description
+Expert guide for designing, documenting, and evolving production-grade APIs. Covers **REST** resource modeling and HTTP semantics, **GraphQL** schema design, **gRPC** with protobuf, and **tRPC** for end-to-end type-safe APIs in TypeScript monorepos. Includes OpenAPI 3.1 documentation, API versioning strategies, rate limiting, idempotency, and contract-first development workflows.
+
+### Trigger Conditions
+- Designing a new API from scratch (REST, GraphQL, gRPC, or tRPC).
+- Evolving an existing API without breaking clients.
+- Documenting APIs with OpenAPI/Swagger.
+- Implementing rate limiting, throttling, or idempotency.
+- Choosing between REST, GraphQL, gRPC, and tRPC.
+- Designing webhook systems.
+- Implementing API authentication (API keys, JWT, OAuth2).
+
+---
+
+### API Protocol Selection Guide
+
+| Criteria | REST | GraphQL | gRPC | tRPC |
+|---|---|---|---|---|
+| **Type Safety** | Manual (OpenAPI) | Schema-enforced | Protobuf | End-to-end TS |
+| **Performance** | Good | Good | Excellent (HTTP/2) | Good |
+| **Browser Support** | Native | Native | Needs proxy | TS/JS only |
+| **Streaming** | SSE / WebSocket | Subscriptions | Native bi-directional | SSE |
+| **Best For** | Public APIs, mobile | Complex data graphs | Microservice-to-service | Next.js full-stack |
+| **Tooling** | Universal | Rich ecosystem | Strong (Go, Java) | Next.js / Expo |
+
+---
+
+### REST API Design Principles
+
+#### Resource Naming Conventions
+```
+Collection:  GET    /api/v1/posts
+Item:        GET    /api/v1/posts/{id}
+Sub-resource:GET    /api/v1/posts/{id}/comments
+Action:      POST   /api/v1/posts/{id}/publish   (use sparingly)
+
+AVOID: /api/v1/getPosts, /api/v1/createPost, /api/v1/deletePost/{id}
+```
+
+#### HTTP Method Semantics
+| Method | Idempotent | Safe | Use Case |
+|---|---|---|---|
+| `GET` | Yes | Yes | Retrieve resources |
+| `POST` | No | No | Create resources, trigger actions |
+| `PUT` | Yes | No | Replace entire resource |
+| `PATCH` | No | No | Partial update |
+| `DELETE` | Yes | No | Remove resource |
+
+#### Consistent Response Structure
+```typescript
+// Success response
+{
+  "data": { "id": "usr_01", "email": "user@example.com" },
+  "meta": { "requestId": "req_xyz", "timestamp": "2026-01-01T00:00:00Z" }
+}
+
+// Paginated list response
+{
+  "data": [...],
+  "meta": {
+    "total": 1234,
+    "page": 2,
+    "pageSize": 20,
+    "hasNextPage": true,
+    "nextCursor": "eyJpZCI6"
+  }
+}
+
+// Error response (RFC 9457 Problem Details)
+{
+  "type": "https://api.example.com/errors/validation-failed",
+  "title": "Validation Failed",
+  "status": 422,
+  "detail": "The 'email' field must be a valid email address.",
+  "instance": "/api/v1/users",
+  "errors": [
+    { "field": "email", "message": "Invalid email format" }
+  ]
+}
+```
+
+#### HTTP Status Codes — Correct Usage
+```
+200 OK          — Successful GET, PUT, PATCH
+201 Created     — Successful POST (include Location header)
+204 No Content  — Successful DELETE
+400 Bad Request — Invalid request body or params
+401 Unauthorized— Missing or invalid authentication
+403 Forbidden   — Authenticated but not authorized
+404 Not Found   — Resource not found
+409 Conflict    — Duplicate key, version conflict
+422 Unprocessable Entity — Validation failure
+429 Too Many Requests    — Rate limit exceeded (include Retry-After)
+500 Internal Server Error— Unexpected server error
+```
+
+---
+
+### API Versioning Strategies
+
+```
+Strategy 1 — URL Path (Recommended for public APIs):
+  GET /api/v1/users
+  GET /api/v2/users
+
+Strategy 2 — Header:
+  GET /api/users
+  Accept: application/vnd.example.v2+json
+
+Strategy 3 — Query Parameter (Avoid in production):
+  GET /api/users?version=2
+```
+
+**Rules for non-breaking changes** (no version bump needed):
+- Adding new optional fields to responses.
+- Adding new optional request parameters.
+- Adding new endpoints.
+
+**Breaking changes** (require new version):
+- Removing or renaming fields.
+- Changing field types.
+- Changing error response structure.
+
+---
+
+### tRPC — End-to-End Type Safety
+
+```typescript
+// server/router.ts
+import { initTRPC, TRPCError } from '@trpc/server';
+import { z } from 'zod';
+
+const t = initTRPC.context<Context>().create();
+export const router = t.router;
+export const publicProcedure = t.procedure;
+export const protectedProcedure = t.procedure.use(({ ctx, next }) => {
+  if (!ctx.session?.user) throw new TRPCError({ code: 'UNAUTHORIZED' });
+  return next({ ctx: { ...ctx, user: ctx.session.user } });
+});
+
+export const appRouter = router({
+  users: router({
+    list: publicProcedure
+      .input(z.object({ page: z.number().int().min(1).default(1) }))
+      .query(async ({ input, ctx }) => {
+        return ctx.db.user.findMany({ skip: (input.page - 1) * 20, take: 20 });
+      }),
+    create: protectedProcedure
+      .input(z.object({ email: z.string().email(), name: z.string().min(2) }))
+      .mutation(async ({ input, ctx }) => {
+        return ctx.db.user.create({ data: input });
+      }),
+  }),
+});
+
+export type AppRouter = typeof appRouter;
+// Client automatically infers all types — no code generation needed
+```
+
+---
+
+### Rate Limiting Implementation
+
+```typescript
+// Sliding window rate limit with Redis (using Upstash)
+import { Ratelimit } from '@upstash/ratelimit';
+import { Redis } from '@upstash/redis';
+
+const ratelimit = new Ratelimit({
+  redis: Redis.fromEnv(),
+  limiter: Ratelimit.slidingWindow(100, '1 m'), // 100 requests/minute
+  analytics: true,
+  prefix: 'api:ratelimit',
+});
+
+// Next.js middleware usage
+export async function rateLimitMiddleware(req: Request) {
+  const ip = req.headers.get('x-forwarded-for') ?? '127.0.0.1';
+  const { success, limit, remaining, reset } = await ratelimit.limit(ip);
+
+  if (!success) {
+    return new Response(JSON.stringify({ error: 'Too Many Requests' }), {
+      status: 429,
+      headers: {
+        'X-RateLimit-Limit': limit.toString(),
+        'X-RateLimit-Remaining': remaining.toString(),
+        'X-RateLimit-Reset': new Date(reset).toISOString(),
+        'Retry-After': Math.ceil((reset - Date.now()) / 1000).toString(),
+      },
+    });
+  }
+}
+```
+
+---
+
+### Idempotency for Mutations
+
+```typescript
+// Client sends Idempotency-Key header for safe retries
+// POST /api/payments
+// Idempotency-Key: a0e4b2c1-unique-uuid-here
+
+async function handlePayment(req: Request) {
+  const idempotencyKey = req.headers.get('idempotency-key');
+  if (!idempotencyKey) return errorResponse(400, 'Idempotency-Key header required');
+
+  // Check cache first
+  const cached = await redis.get(`idempotency:${idempotencyKey}`);
+  if (cached) return Response.json(JSON.parse(cached), { status: 200 });
+
+  // Process payment
+  const result = await processPayment(await req.json());
+
+  // Cache result for 24 hours
+  await redis.setex(`idempotency:${idempotencyKey}`, 86400, JSON.stringify(result));
+  return Response.json(result, { status: 201 });
+}
+```
+
+---
+
+### OpenAPI 3.1 Documentation
+
+```yaml
+# openapi.yaml
+openapi: "3.1.0"
+info:
+  title: Example API
+  version: "1.0.0"
+  description: "RESTful API for Example SaaS"
+
+paths:
+  /api/v1/users:
+    get:
+      operationId: listUsers
+      summary: List all users
+      tags: [Users]
+      security: [{ bearerAuth: [] }]
+      parameters:
+        - name: page
+          in: query
+          schema: { type: integer, minimum: 1, default: 1 }
+        - name: pageSize
+          in: query
+          schema: { type: integer, minimum: 1, maximum: 100, default: 20 }
+      responses:
+        "200":
+          description: Users list
+          content:
+            application/json:
+              schema:
+                $ref: "#/components/schemas/UserListResponse"
+        "401":
+          $ref: "#/components/responses/Unauthorized"
+
+components:
+  securitySchemes:
+    bearerAuth:
+      type: http
+      scheme: bearer
+      bearerFormat: JWT
+```
+
+---
+
+<a name="bahasa-indonesia"></a>
+## Bahasa Indonesia
+
+### Deskripsi
+Panduan ahli untuk merancang, mendokumentasikan, dan mengembangkan API berkualitas produksi. Mencakup pemodelan resource **REST** dan semantik HTTP, desain skema **GraphQL**, **gRPC** dengan protobuf, dan **tRPC** untuk API end-to-end type-safe di TypeScript. Termasuk dokumentasi OpenAPI 3.1, strategi versioning API, rate limiting, idempotency, dan alur kerja contract-first.
+
+### Kondisi Pemicu
+- Merancang API baru dari nol (REST, GraphQL, gRPC, atau tRPC).
+- Mengembangkan API yang ada tanpa merusak klien.
+- Mendokumentasikan API dengan OpenAPI/Swagger.
+- Mengimplementasikan rate limiting, throttling, atau idempotency.
+- Memilih antara REST, GraphQL, gRPC, dan tRPC.
+- Merancang sistem webhook.
+
+### Panduan Pemilihan Protokol API
+
+- **REST**: API publik, klien mobile, konsumsi universal.
+- **GraphQL**: Data graph kompleks, kebutuhan query fleksibel dari klien.
+- **gRPC**: Komunikasi layanan-ke-layanan dengan performa tinggi.
+- **tRPC**: Proyek full-stack TypeScript monorepo (Next.js + backend).
+
+### Prinsip REST
+
+1. **Penamaan resource**: Gunakan kata benda jamak (`/posts`, bukan `/getPost`).
+2. **Status HTTP**: Gunakan kode yang tepat (201 untuk create, 204 untuk delete).
+3. **Konsistensi respons**: Selalu kembalikan struktur `data` + `meta` yang konsisten.
+4. **Versioning**: Gunakan URL path (`/api/v1/`) untuk API publik.
+5. **Idempotency**: Implementasikan `Idempotency-Key` header untuk operasi mutasi yang kritis.
+6. **Rate Limiting**: Selalu sertakan header `X-RateLimit-*` dan kode `429` yang benar.

package/skills/app-analyzer-optimizer/SKILL.md

@@ -0,0 +1,189 @@
+---
+name: app-analyzer-optimizer
+description: "Deeply analyzes application architecture and structure to perform audit, bottleneck detection, and code/performance optimization / Mempelajari arsitektur dan struktur aplikasi secara mendalam untuk melakukan audit, deteksi bottleneck, serta optimasi performa dan kode."
+author: "Roedy Rustam"
+---
+
+# App Analyzer & Optimizer (2026 Edition)
+
+[English](#english) | [Bahasa Indonesia](#bahasa-indonesia)
+
+---
+
+<a name="english"></a>
+## English
+
+### Description
+Deep application analysis and optimization skill. Performs architectural audits, bottleneck detection, bundle analysis, database query profiling, and AI-assisted code review across Next.js, React, Node.js, Go, Python, and Rust applications.
+
+### Trigger Conditions
+- Auditing an existing codebase for architectural issues or technical debt.
+- Detecting performance bottlenecks (slow API routes, large bundles, N+1 queries).
+- Analyzing bundle size and suggesting code splitting opportunities.
+- Reviewing code quality (complexity, duplication, dead code).
+- Using AI-assisted tools to accelerate code review and analysis.
+
+### Analysis Protocol (5 Phases)
+
+#### Phase 1: Architecture Discovery
+```bash
+# Map the entire project structure
+find . -type f -name "*.ts" -o -name "*.tsx" -o -name "*.go" | head -100
+# Count lines per file (find largest files)
+find . -name "*.ts" -exec wc -l {} + | sort -rn | head -20
+# Find circular dependencies (TypeScript/JS)
+npx madge --circular --extensions ts,tsx src/
+```
+
+#### Phase 2: Bundle Analysis (Next.js / Vite)
+```bash
+# Next.js bundle analyzer
+ANALYZE=true next build
+
+# Or install dedicated tool
+npx @next/bundle-analyzer
+
+# Vite bundle visualization
+npx vite-bundle-visualizer
+
+# Check for duplicate dependencies
+npx depcheck
+npx bundle-phobia-cli check package.json
+```
+
+Key bundle red flags:
+- Any single chunk > 500KB (uncompressed).
+- Importing entire libraries (`import _ from 'lodash'` vs `import debounce from 'lodash/debounce'`).
+- Moment.js (replace with `date-fns` or `Temporal`).
+- `node_modules` leaking into client bundle.
+
+#### Phase 3: Database Query Analysis
+```sql
+-- PostgreSQL: Find slow queries
+SELECT query, mean_exec_time, calls, total_exec_time
+FROM pg_stat_statements
+ORDER BY mean_exec_time DESC
+LIMIT 20;
+
+-- Find missing indexes (sequential scans on large tables)
+SELECT schemaname, tablename, attname, n_distinct, correlation
+FROM pg_stats
+WHERE tablename = 'your_table'
+ORDER BY n_distinct DESC;
+
+-- Detect N+1 queries: Enable query logging
+-- In Drizzle:
+const db = drizzle(client, { logger: true });
+-- In Prisma:
+DATABASE_URL="...?connection_limit=5" prisma studio
+```
+
+#### Phase 4: AI-Assisted Code Review
+Use AI tools to accelerate analysis:
+
+| Tool | Purpose |
+|---|---|
+| **CodeRabbit** | Automated PR review, pattern detection |
+| **Sourcegraph Cody** | Codebase-wide semantic search and explanation |
+| **GitHub Copilot** | Inline suggestions and refactoring |
+| **Cursor / Windsurf** | AI IDE with full-repo context |
+
+AI review prompts for Gemini Agent:
+```
+Analyze all files in src/features/ and identify:
+1. Functions longer than 30 lines
+2. Duplicated business logic across files
+3. Missing error handling in async functions
+4. Components that directly call APIs (violating separation of concerns)
+```
+
+#### Phase 5: Performance Profiling
+
+**Frontend (React / Next.js):**
+```bash
+# React DevTools Profiler — identify render bottlenecks
+# Chrome DevTools > Performance tab > Record interaction
+
+# Lighthouse CI — automated CWV tracking
+npm install -g @lhci/cli
+lhci autorun
+```
+
+**Backend (Node.js):**
+```bash
+# Built-in Node.js profiler
+node --prof server.js
+node --prof-process isolate-*.log > processed.txt
+
+# Clinic.js — flamegraph, bubble chart, doctor
+npm install -g clinic
+clinic doctor -- node server.js
+clinic flame -- node server.js
+```
+
+**Go:**
+```bash
+# Built-in pprof profiler
+go tool pprof http://localhost:6060/debug/pprof/profile?seconds=30
+go tool pprof -http=:8080 profile.out
+```
+
+### Common Bottleneck Patterns & Fixes
+
+| Bottleneck | Symptom | Fix |
+|---|---|---|
+| N+1 queries | DB calls proportional to list length | Add `.include()` / JOIN or DataLoader |
+| Missing indexes | Slow queries on filtered columns | `CREATE INDEX CONCURRENTLY` |
+| Unoptimized images | Large LCP, slow page load | Next.js `<Image>`, WebP, lazy loading |
+| Over-fetching | Fetching full objects when only 1 field needed | Select specific columns |
+| No pagination | Fetching entire tables | Add `LIMIT/OFFSET` or cursor pagination |
+| Blocking main thread | High INP, unresponsive UI | `useTransition`, web workers |
+| No caching | Same data fetched repeatedly | Redis, React Query staleTime, HTTP cache |
+| Bundle bloat | Large JS payload | Tree-shaking, code splitting, lazy imports |
+
+---
+
+<a name="bahasa-indonesia"></a>
+## Bahasa Indonesia
+
+### Deskripsi
+Skill analisis dan optimasi aplikasi mendalam. Melakukan audit arsitektur, deteksi bottleneck, analisis bundle, profiling query database, dan code review berbantuan AI di aplikasi Next.js, React, Node.js, Go, Python, dan Rust.
+
+### Kondisi Pemicu
+- Mengaudit codebase yang ada untuk masalah arsitektur atau hutang teknis.
+- Mendeteksi bottleneck performa (rute API lambat, bundle besar, query N+1).
+- Menganalisis ukuran bundle dan menyarankan peluang code splitting.
+- Meninjau kualitas kode (kompleksitas, duplikasi, kode mati).
+- Menggunakan tool berbantuan AI untuk mempercepat code review dan analisis.
+
+### Protokol Analisis (5 Fase)
+
+#### Fase 1: Penemuan Arsitektur
+Petakan seluruh struktur proyek, hitung baris per file untuk menemukan file terbesar, dan deteksi dependensi circular dengan `npx madge --circular`.
+
+#### Fase 2: Analisis Bundle (Next.js / Vite)
+Gunakan `ANALYZE=true next build` atau `npx vite-bundle-visualizer`. Tanda bahaya bundle: chunk tunggal > 500KB, mengimpor library penuh, Moment.js, atau `node_modules` yang bocor ke bundle klien.
+
+#### Fase 3: Analisis Query Database
+Gunakan `pg_stat_statements` untuk menemukan query lambat. Cari scan sequential pada tabel besar (tanda indeks yang hilang). Aktifkan logging query di Drizzle/Prisma untuk mendeteksi pola N+1.
+
+#### Fase 4: Code Review Berbantuan AI
+Gunakan CodeRabbit untuk review PR otomatis, Sourcegraph Cody untuk pencarian semantik seluruh codebase, dan Gemini Agent dengan prompt analisis spesifik untuk menemukan fungsi panjang, logika bisnis yang diduplikasi, dan error handling yang hilang.
+
+#### Fase 5: Profiling Performa
+- **Frontend**: React DevTools Profiler, Lighthouse CI.
+- **Backend Node.js**: `node --prof`, Clinic.js untuk flamegraph.
+- **Go**: `go tool pprof` untuk CPU dan memory profiling.
+
+### Pola Bottleneck Umum & Perbaikan
+
+| Bottleneck | Gejala | Perbaikan |
+|---|---|---|
+| Query N+1 | Panggilan DB proporsional dengan panjang daftar | Tambahkan `.include()` / JOIN atau DataLoader |
+| Indeks yang hilang | Query lambat pada kolom yang difilter | `CREATE INDEX CONCURRENTLY` |
+| Gambar tidak dioptimalkan | LCP besar, halaman lambat | Next.js `<Image>`, WebP, lazy loading |
+| Over-fetching | Mengambil objek penuh saat hanya 1 field dibutuhkan | Pilih kolom spesifik |
+| Tanpa paginasi | Mengambil seluruh tabel | Tambahkan `LIMIT/OFFSET` atau cursor pagination |
+| Memblokir thread utama | INP tinggi, UI tidak responsif | `useTransition`, web workers |
+| Tanpa caching | Data yang sama diambil berulang kali | Redis, React Query staleTime, HTTP cache |
+| Bundle membengkak | Payload JS besar | Tree-shaking, code splitting, lazy imports |

package/skills/asisten_ramah/SKILL.md

@@ -0,0 +1,41 @@
+---
+name: asisten-ramah
+description: "Skill to make Antigravity respond in a friendly manner / Skill untuk membuat Antigravity membalas dengan ramah."
+author: "Roedy Rustam"
+---
+
+# Asisten Ramah / Friendly Assistant
+
+[English](#english) | [Bahasa Indonesia](#bahasa-indonesia)
+
+---
+
+<a name="english"></a>
+## English
+
+### Description
+This skill is a basic example to make Antigravity (me) always respond with a friendly, warm, and polite language style.
+
+### Instructions
+- Always start the conversation or response with a friendly greeting (e.g., "Hello!", "Hi there!", or "Ready to help!").
+- Always be polite and use plenty of emojis in responses.
+- If the user asks about code, always provide words of encouragement before presenting the code.
+
+### Trigger Conditions
+Always active for every interaction with the user.
+
+---
+
+<a name="bahasa-indonesia"></a>
+## Bahasa Indonesia
+
+### Deskripsi
+Skill ini adalah contoh dasar untuk membuat Antigravity (saya) selalu membalas dengan gaya bahasa tertentu yang ramah dan sopan.
+
+### Instruksi
+- Anda harus selalu memulai percakapan atau jawaban dengan kata sapaan yang ramah (misalnya: "Halo!", "Hai di sana!", atau "Siap membantu!").
+- Selalu bersikap sopan dan gunakan banyak emoji dalam jawaban.
+- Jika pengguna bertanya tentang kode, selalu berikan semangat sebelum memberikan kodenya.
+
+### Kondisi Pemicu
+Selalu aktif untuk setiap interaksi dengan pengguna.

package/skills/authentication-identity-expert/SKILL.md

@@ -0,0 +1,45 @@
+---
+name: authentication-identity-expert
+description: "Expert guide for implementing secure authentication, authorization (RBAC/ABAC), OAuth2, and identity management (Clerk, Auth.js, Supabase Auth) / Panduan ahli untuk autentikasi dan otorisasi."
+author: "Antigravity"
+---
+
+# Authentication & Identity Expert / Ahli Autentikasi & Identitas
+
+[English](#english) | [Bahasa Indonesia](#bahasa-indonesia)
+
+---
+
+<a name="english"></a>
+## English
+
+### Description
+Expert guide for implementing robust and secure authentication and authorization systems in web and mobile applications. Covers JWT, Session management, OAuth2 providers, Identity as a Service (Clerk, Supabase Auth, Auth0), and Role/Attribute-Based Access Control (RBAC/ABAC).
+
+### Instructions
+- **Never Roll Your Own Crypto**: Always use established libraries (like `bcrypt` or `argon2`) for hashing passwords if not using an Identity Provider.
+- **Session & Token Management**: Keep JWT lifetimes short (e.g., 15 minutes) and use secure, HttpOnly, SameSite cookies for refresh tokens to prevent XSS attacks.
+- **OAuth2 & SSO Integration**: When implementing OAuth, strictly validate the `state` parameter to mitigate CSRF attacks during the callback phase.
+- **Authorization (RBAC/ABAC)**: Enforce authorization checks at the server level (API routes, database queries), not just on the UI layer. Never expose sensitive data based on client-side roles alone.
+- **MFA (Multi-Factor Authentication)**: Recommend and implement MFA/2FA for administrative or high-privilege accounts.
+
+### Trigger Conditions
+Active whenever the user is working on login/signup flows, session management, OAuth integration, role-based access control, or integrating Auth.js, Clerk, Supabase Auth, or Auth0.
+
+---
+
+<a name="bahasa-indonesia"></a>
+## Bahasa Indonesia
+
+### Deskripsi
+Panduan ahli untuk mengimplementasikan sistem autentikasi dan otorisasi yang aman dan tangguh pada aplikasi web dan mobile. Mencakup JWT, manajemen Sesi, penyedia OAuth2, Identity as a Service (Clerk, Supabase Auth, Auth0), dan Role/Attribute-Based Access Control (RBAC/ABAC).
+
+### Instruksi
+- **Jangan Membuat Kriptografi Sendiri**: Selalu gunakan library standar (seperti `bcrypt` atau `argon2`) untuk hashing password jika tidak menggunakan penyedia identitas (IdP).
+- **Manajemen Sesi & Token**: Jaga masa aktif JWT tetap singkat (misal: 15 menit) dan gunakan cookie *HttpOnly, SameSite* yang aman untuk token *refresh* guna mencegah serangan XSS.
+- **Integrasi OAuth2 & SSO**: Saat mengimplementasikan OAuth, validasi parameter `state` secara ketat untuk memitigasi serangan CSRF selama fase callback.
+- **Otorisasi (RBAC/ABAC)**: Terapkan pengecekan otorisasi pada level server (API route, query database), bukan hanya pada lapisan UI. Jangan pernah mengekspos data sensitif hanya berdasarkan *role* di sisi klien.
+- **MFA (Multi-Factor Authentication)**: Rekomendasikan dan implementasikan MFA/2FA untuk akun administratif atau hak akses tinggi.
+
+### Kondisi Pemicu
+Aktif setiap kali pengguna sedang mengerjakan alur login/signup, manajemen sesi, integrasi OAuth, role-based access control, atau mengintegrasikan Auth.js, Clerk, Supabase Auth, atau Auth0.