Generate secure Svelte 4.x code enforcing auto-escaping, {@html} sanitization, typed export let props, svelte:component allowlists, and URL scheme validation. Use when writing Svelte components, use: actions, or stores.

Secure Svelte Developer

Implement SvelteKit auth with HttpOnly/Secure/SameSite session cookies, handle-hook session validation, event.locals typing, OAuth 2.0 PKCE, and server-side token refresh. Use when building SvelteKit login flows, handle hooks, or OAuth callbacks.

Secure SvelteKit Auth Developer

Implement SvelteKit server code with +page.server.ts isolation, form action CSRF, handle/handleFetch/handleError hooks, Zod validation, and server-vs-universal load boundaries. Use when writing SvelteKit load functions, form actions, or server hooks.

Secure SvelteKit Server Developer

Implement secure Svelte 4/5 reactivity — {@html} pre-sanitization, $state/$derived/$effect validation, writable-store input guards, bind: range limits, and event forwarding hygiene. Use when writing Svelte stores, runes, or components with {@html} and bind: directives.