--- name: fondo-security-basics-216b0fc42cd1 description: 'Apply security best practices for Fondo including OAuth token management, financial data protection, SOC 2 compliance, and access control. Trigger: "fondo security", "fondo data protection", "fondo SOC 2", "fondo access control". ' allowed-tools: Read, Write, Grep version: 1.6.0 license: MIT author: Jeremy Longshore tags: - saas - accounting - fondo compatibility: Designed for Claude Code --- # Fondo Security Basics ## Prerequisites A security owner, scoped secret manager, financial-data access policy, review cadence, and synthetic fixtures. ## Instructions Use least-privilege credentials per environment; verify signed events and idempotency; restrict financial and tax data to approved systems; redact diagnostics; rotate credentials on suspected exposure. ## Output Maintain a security receipt with scope, secret reference, access-review date, control result, owner, and redacted incident state. Do not include financial data or secrets. ## Examples Verify a fictional signed event is processed once, an invalid signature is rejected without payload logging, and revoking a staging credential blocks future requests. ## Overview Fondo handles startup tax preparation, bookkeeping, and R&D tax credits containing SSNs, EINs, bank account details, revenue figures, and complete tax returns. A breach exposes founder personal tax data, company financials, and IRS filing details. Protect OAuth connections to banking/payroll systems, exported financial documents, and team access controls with the same rigor as a CPA firm. ## API Key Management ```typescript function createFondoClient(): { apiKey: string; baseUrl: string } { const apiKey = process.env.FONDO_API_KEY; if (!apiKey) { throw new Error("Missing FONDO_API_KEY — store in secrets manager, never in code"); } // Fondo keys access tax returns and SSN/EIN data — treat as highest sensitivity console.log("Fondo client initialized (key suffix:", apiKey.slice(-4), ")"); return { apiKey, baseUrl: "https://api.fondo.com/v1" }; } ``` ## Webhook Signature Verification ```typescript import crypto from "crypto"; import { Request, Response, NextFunction } from "express"; function verifyFondoWebhook(req: Request, res: Response, next: NextFunction): void { const signature = req.headers["x-fondo-signature"] as string; const secret = process.env.FONDO_WEBHOOK_SECRET!; const expected = crypto.createHmac("sha256", secret).update(req.body).digest("hex"); if (!signature || !crypto.timingSafeEqual(Buffer.from(signature), Buffer.from(expected))) { res.status(401).send("Invalid signature"); return; } next(); } ``` ## Input Validation ```typescript import { z } from "zod"; const TaxFilingSchema = z.object({ entity_id: z.string().uuid(), tax_year: z.number().int().min(2015).max(2030), filing_type: z.enum(["1120", "1120S", "1065", "941", "R&D_credit"]), ein: z.string().regex(/^\d{2}-\d{7}$/), revenue: z.number().nonnegative(), status: z.enum(["draft", "review", "filed", "amended"]), }); function validateTaxFiling(data: unknown) { return TaxFilingSchema.parse(data); } ``` ## Data Protection ```typescript const FONDO_PII_FIELDS = ["ssn", "ein", "bank_account", "routing_number", "tax_return_url", "revenue", "salary"]; function redactFondoLog(record: Record): Record { const redacted = { ...record }; for (const field of FONDO_PII_FIELDS) { if (field in redacted) redacted[field] = "[REDACTED]"; } return redacted; } ``` ## Security Checklist - [ ] API keys stored in secrets manager, never in code - [ ] OAuth connections (Gusto, QuickBooks, Plaid, Stripe) reviewed quarterly - [ ] Financial exports never committed to git (`.gitignore` enforced) - [ ] SSN and EIN values never logged in plaintext - [ ] Team roles follow least-privilege (Owner/Admin/Viewer/CPA) - [ ] Two-factor authentication enabled on Fondo account - [ ] Exported tax documents encrypted with GPG before storage - [ ] Bank connections use Plaid (encrypted, not screen-scraping) ## Error Handling | Vulnerability | Risk | Mitigation | |---|---|---| | Leaked API key | Full access to tax returns and SSN/EIN data | Secrets manager + rotation | | Unencrypted financial exports | Tax data exposed via CSV on disk | GPG encryption + secure deletion | | Stale OAuth tokens | Compromised banking/payroll connections | Quarterly OAuth review + revocation | | Overly broad team access | Viewer sees SSN/salary data | Role-based access control enforcement | | Tax data in application logs | IRS compliance violation | Field-level PII redaction | ## Resources - [Fondo Security](https://fondo.com) - [OWASP API Security Top 10](https://owasp.org/www-project-api-security/) ## Next Steps See `fondo-prod-checklist`. --- Source attribution: jeremylongshore Original project: https://github.com/jeremylongshore/claude-code-plugins-plus-skills/blob/ab85a061f7bcc039dac13ee193de7a4cd4388571/plugins/saas-packs/fondo-pack/skills/fondo-security-basics/SKILL.md License: MIT License information: https://opensource.org/license/mit Original upstream instructions; downloaded from Mega AI Hub. ## Upstream license notice MIT License Copyright (c) 2025 Jeremy Longshore Permission is hereby granted, free of charge, to any person obtaining a copy of this software and associated documentation files (the "Software"), to deal in the Software without restriction, including without limitation the rights to use, copy, modify, merge, publish, distribute, sublicense, and/or sell copies of the Software, and to permit persons to whom the Software is furnished to do so, subject to the following conditions: The above copyright notice and this permission notice shall be included in all copies or substantial portions of the Software. THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE. # Mega AI Hub resource metadata Creator / publisher: jeremylongshore Original project: https://github.com/jeremylongshore/claude-code-plugins-plus-skills/blob/ab85a061f7bcc039dac13ee193de7a4cd4388571/plugins/saas-packs/fondo-pack/skills/fondo-security-basics/SKILL.md Attribution basis: Source repository record Fields of work: Finance & Accounting, Marketing, Sales Roles: Accountant, Business Development, CFO / FP&A, Financial Analyst, Growth Marketer Specialties: API, Design, Word Documents, Frontend, Git, Stripe Tools: Fondo Country applicability: Country not specified Classification basis: Source catalog labels Instruction SHA-256: 38eece6673e172eb330e53e60f091def818d676c25a2e2ee826d7cf84f6ddcd2