Mohd Zaheer Uddin

Provisions, configures, and deploys any backend, database, or third-party service (e.g. Supabase, Firebase, Stripe, Postgres, Auth0, AWS, MongoDB Atlas, Vercel, Resend) through the command line — from first credential to a live, deployed backend — without the agent ever seeing or handling the raw API key/token. Use whenever the user asks to "set up", "connect", "integrate", "configure", "provision", "deploy", or "hook up" a backend/service/API, even without naming the service, or phrases like "add a database" or "get this live." Authenticates via the provider's official CLI/OAuth login where possible; otherwise the user enters credentials directly in their own terminal into `.env`, never through chat. Checks the user's plan/subscription tier and fetches current official docs when exact CLI steps aren't already known. Use instead of guessing at setup/deploy steps from memory, and never as a substitute for asking the user for missing credentials.

Designs and builds real, production websites — landing pages, redesigns, web apps — with a non-templated visual identity (real design tokens, deliberate fonts), pulling components from an internal library plus React Bits/21st.dev MCP servers when they fit (always restyled to the project's colors, never left default), tests every page across desktop/tablet/mobile with Playwright, checks the build, pushes to GitHub, deploys live. Use whenever the user asks to "build a website," "design a landing page," "redesign," "create a UI," or describes a site to build/style, even without saying "frontend." If unspecified, ask what it's for first. "Redesign" means the whole site — home, about, contact, pricing, real privacy/terms — every page built for real, no stubs. Asks color/mood/framework before building. Captures real screenshots of the user's actual product via Playwright, never a fabricated mockup. Never lorem ipsum, placeholders, or duplicate designs across projects. Websites only.

Scans every file in a project — code, config, markdown, docs, CI files, infra-as-code, env files, and everything else regardless of extension — for real security vulnerabilities, presents a full plain-language report, and only fixes what the user explicitly approves — never fixes anything unasked. Use this whenever the user asks to "secure", "audit", "harden", "check for vulnerabilities", "protect against hackers", or "make this production-safe" for a codebase or live site, or after backend-setup-wizard has just provisioned something and the user wants it locked down. Works on any codebase, standalone or as a follow-up to backend-setup-wizard, and is safe to run on a real company's production codebase since nothing changes without sign-off. Produces a markdown audit report covering every finding, what was approved, what was fixed, and what's still outstanding.