Bulletproof React

SkillSecurity

Gives your agent proven React project architecture patterns for structuring code, managing state, APIs, and testing.

Available today. Use it from your connected AI after setup.

Add ahel to your AI once: Claude, ChatGPT, Cursor, Claude Code or Codex. Then ask it to use this.

Then ask your AI: use the Bulletproof React skill

About this skill

Bulletproof React architecture patterns for scalable, maintainable applications. Covers feature-based project structure, component patterns, state management boundaries, API layer design, error handling, security, and testing strategies. Use when structuring a React project, designing application ar

What this skill tells your AI

The instructions your AI receives, as published by yamcodes/arkenv in skills/bulletproof-react/SKILL.md and read by ahel’s review.

Architecture patterns for building scalable, maintainable React applications. Based on bulletproof-react.

Core references

TopicDescriptionReference
Project StructureFeature-based organization, unidirectional architecture, ESLint enforcementproject-structure
Components & StylingComponent hierarchy, wrapping 3rd party libs, headless vs styled librariescomponents-and-styling
API LayerAPI client, request declarations, query/mutation hook patternsapi-layer
State ManagementComponent, application, server cache, form, and URL state categoriesstate-management
Error HandlingError boundaries, API errors, error tracking with Sentryerror-handling
TestingUnit, integration, e2e strategies with Vitest, Testing Library, Playwright, MSWtesting
Project StandardsESLint, Prettier, TypeScript, Husky, absolute imports, file namingproject-standards
SecurityAuthentication, token storage, XSS prevention, RBAC/PBAC authorizationsecurity
PerformanceCode splitting, data prefetching, state optimization, children patternperformance

Project structure

Organize by feature, not by file type:

src/
├── app/                # Application shell (routes, providers, router)
├── assets/             # Static files (images, fonts)
├── components/         # Shared, reusable UI components
├── config/             # Environment variables, constants
├── features/           # Feature-based modules
├── hooks/              # Shared custom hooks
├── lib/                # Pre-configured library wrappers
├── stores/             # Global client state
├── testing/            # Test utilities, MSW handlers, factories
├── types/              # Shared TypeScript types
└── utils/              # Pure utility functions

Feature modules

features/users/
├── api/            # API functions and query hooks
├── components/     # Feature-specific components
├── hooks/          # Feature-specific hooks
├── types/          # Feature-specific types
└── utils/          # Feature-specific utilities

Rules:

  • Features should not import from other features. Compose at the app level.
  • Code flows one direction: shared → features → app.
  • Promote to shared directories only when reused by 2+ features.
  • Prefer direct imports over barrel re-exports for Vite tree-shaking.

Component hierarchy

Page Components          → route-level, compose features, handle layout
  └── Feature Components → feature-specific, business logic
        └── UI Components      → shared primitives, no business logic

API layer pattern

// Pure API function
function getUsers(params?: GetUsersParams): Promise<UsersResponse> {
    return api.get("/users", { params });
}

// Query hook wrapping the API function
function useUsers(params?: GetUsersParams) {
    return useQuery({
        queryKey: ["users", params],
        queryFn: () => getUsers(params),
    });
}

State management boundaries

State TypeSolutionExamples
Server stateTanStack QueryUser data, posts, API responses
Client state (global)Zustand / JotaiTheme, sidebar open, user preferences
Client state (local)useState / useReducerForm inputs, toggles, modal open
URL stateURL search params / routerFilters, pagination, active tab
Form stateReact Hook FormMulti-step forms, validation

Don't mix server and client state. Never copy query data into useState.

Error hierarchy

App Error Boundary          → catches unrecoverable crashes
  └── Route Error Boundary     → catches route-level failures, shows retry
        └── Feature Error Boundary   → catches feature-specific errors

Testing strategy

LayerToolWhat to Test
ComponentsTesting LibraryRender output, user interactions, a11y
HooksrenderHookState changes, side effects
APIMSWRequest/response handling, error states
IntegrationTesting Library + MSWFull feature flows (render → interact → verify)
E2EPlaywrightCritical user journeys

Conventions

ItemConventionExample
ComponentsPascalCaseUserCard.tsx
HookscamelCase, use prefixuseUsers.ts
UtilitiescamelCaseformatDate.ts
TypesPascalCaseUser, CreateUserInput
ConstantsUPPER_SNAKE_CASEMAX_RETRIES
Directorieskebab-caseuser-settings/
Fileskebab-caseuser-card.tsx

Imports

Use path aliases to avoid deep relative imports:

import { Button } from "@/components/ui/button";
import { useUsers } from "@/features/users/api";

Configure @/ as the src/ alias in tsconfig.json.

Signals

GitHub stars
144
Forks
6
Last commit
Sep 2026

ahel review

  • K1binfo
    installs-packages (in references/project-standards.md)

Automated review, not a security audit. Ruleset v1+k2.

Advanced
Item type
skill
Key
bulletproof-react
Source
github.com/yamcodes/arkenv