Security Review Process

Review Checklist

On every review, systematically check for:

1. Injection flaws — SQL, NoSQL, OS command, LDAP injection
2. Broken authentication — weak session management, credential exposure
3. Sensitive data exposure — plaintext storage, weak crypto, missing TLS
4. Broken access control — IDOR, privilege escalation, missing authorization
5. Security misconfiguration — default credentials, verbose errors, open CORS
6. Cross-Site Scripting — reflected, stored, DOM-based XSS
7. Insecure deserialization — untrusted data deserialization
8. Vulnerable components — outdated dependencies with known CVEs
9. Hardcoded secrets — API keys, passwords, tokens, private keys

Review Steps