Platform Engineering

Cross-Platform Development Rulebook

Three pillars govern every application you ship -- Security, Architecture, and Performance. Each rule is tagged with severity (MUST/DO/DON'T) and platform applicability.

Quick Platform Decision Matrix

| Concern | SPA | PWA | Mobile | Electron | Tauri | |---------|-----|-----|--------|----------|-------| | Auth token storage | JS memory + httpOnly cookies | JS memory + httpOnly cookies | Platform Keychain/Keystore | OS credential store | OS credential store | | OAuth flow | Auth Code + PKCE | Auth Code + PKCE | System browser + PKCE | Standard PKCE | Standard PKCE | | XSS impact | Session hijack | + persistent SW hijack | WebView bridge access | XSS to RCE | Limited to web context | | CSP | Critical | Critical | WebViews only | Critical | Relevant | | Offline strategy | Optional | IndexedDB + Cache API + SW | Room/CoreData + sync queue | Optional | Optional | | Bundle target | <170KB compressed JS | <170KB compressed JS | <20MB APK/IPA | 80-150MB (Chromium) | <10MB total | | API style | REST or GraphQL | REST (SW caching) | GraphQL (fewer round-trips) | REST (server-side aggregation) | REST | | State management | Zustand/Redux + TanStack Query | IndexedDB + Cache API | ViewModel+StateFlow / SwiftUI | IPC + context isolation | Rust invoke commands |

When to Load References

• Security review or audit: Load server-validation, auth-tokens, passkeys-webauthn, api-security, xss-csp, secrets-management, platform-security
• Architecture decisions: Load client-server-architecture, api-design, offline-first, infrastructure
• Performance optimization: Load frontend-performance, backend-and-platform-performance
• Full platform review: Load all 13 references

Reference Materials

Security (Part 1)

1. server-validation.md -- Server-side validation rules, trust boundaries, real-world bypass incidents
2. auth-tokens.md -- Token storage per platform, OAuth 2.1 flows, JWT best practices, secure storage APIs
3. passkeys-webauthn.md -- WebAuthn Level 3 / passkey patterns, server-side verification, cross-platform support, cloned-authenticator detection
4. api-security.md -- Endpoint auth, rate limiting, CORS, OWASP API risks, Peloton/Parler case studies
5. xss-csp.md -- XSS severity by platform, CSP directives, anti-CSRF, sanitization, British Airways incident
6. secrets-management.md -- Secret exposure risks, environment variables, vault services, GitGuardian stats
7. platform-security.md -- Mobile (Keychain/Keystore, cert pinning), Electron (nodeIntegration, contextIsolation, sandbox), Tauri (deny-by-default), PWA (service worker scope, Cache API risks), security headers matrix

Architecture (Part 2)

1. client-server-architecture.md -- Thin client principle, BFF pattern, server-authoritative design
2. api-design.md -- REST vs GraphQL trade-offs by platform, pagination strategies, state management per platform
3. offline-first.md -- Conflict resolution strategies (LWW, CRDTs, OT), optimistic UI, sync patterns
4. infrastructure.md -- Monolith-first principle, database access patterns, CI/CD pipelines per platform, observability, feature flag lifecycle

Performance (Part 3)

1. frontend-performance.md -- Bundle size optimization, image formats and responsive loading, Core Web Vitals (LCP, INP, CLS) with business impact data
2. backend-and-platform-performance.md -- API/DB performance (pagination, indexing, connection pooling), mobile battery/memory, SSR/SSG/ISR rendering strategies, CDN caching patterns

Source & license

This open-source skill is cataloged on AgentStack and links to its original source — we do not rehost the code.

• Author: acaprino
• Source: acaprino/claude-code-daodan
• License: MIT

Install and usage instructions live in the source repository linked above.