Agent skill · security · jeremylongshore
fondo-security-basics
Apply security best practices for Fondo including OAuth token management,
Why this skill is useful
Provides specific security practices and code snippets for managing sensitive financial data and compliance that the AI wouldn't reliably generate on its own.
What it needs
About 2k tokens when loaded. Last updated 2026-08-07. 2,604 stars on the source repository.
What this skill does
Fondo Security Basics Prerequisites A security owner, scoped secret manager, financial-data access policy, review cadence, and synthetic fixtures. Instructions Use least-privilege credentials per environment; verify signed events and idempotency; restrict financial and tax data to approved systems; redact diagnostics; rotate credentials on suspected exposure. Output Maintain a security receipt with scope, secret reference, access-review date, control result, owner, and redacted incident state. Do not include financial data or secrets. Examples Verify a fictional signed event is processed once, an invalid signature is rejected without payload logging, and revoking a staging credential blocks future requests. Overview Fondo handles startup tax preparation, bookkeeping, and R&D tax credits containing SSNs, EINs, bank account details, revenue figures, and complete tax returns. A breach exposes founder personal tax data, company financials, and IRS filing details. Protect OAuth connections to banking/payroll systems, exported financial documents, and team access controls with the same rigor as a CPA firm. API Key Management Webhook Signature Verification Input Validation Data Protection Security Checklist [ ] API keys stored in secrets manager, never in code [ ] OAuth connections (Gusto, QuickBooks, Plaid, Stripe) reviewed quarterly [ ] Financial exports never committed to git (.gitignore enforced) [ ] SSN and EIN values never logged in plaintext [ ] Team roles follow least-privilege (Owner/Admin/Viewer/CPA) [ ] Two-factor authentication enabled on Fondo account [ ] Exported tax documents encrypted with GPG before storage [ ] Bank connections use Plaid (encrypted, not screen-scraping) Error Handling Vulnerability Risk Mitigation --- --- --- Leaked API key Full access to tax returns and SSN/EIN data Secrets manager + rotation Unencrypted financial exports Tax data exposed via CSV on disk GPG encryption + secure deletion Stale OAuth tokens Compromised banking/payroll conne …
How to use it
Reference it in AdaL, Claude Code, Cursor or any coding agent — nothing to install:
@skills jeremylongshore/fondo-security-basics