Review Security

When To Use

Use this skill for security-focused review or when code touches protected data, authentication, authorization, files, external calls, queues, or APIs.

Inputs Needed

• Threat model, changed files, actors, assets, trust boundaries, routes, jobs, events, and tests.

Workflow

1. Identify actors, assets, and trust boundaries.
2. Check authentication and authorization.
3. Check validation and mass assignment.
4. Check output exposure and serialization.
5. Check raw queries, file uploads, redirects, SSRF, secrets, logs, queues, and events.
6. Check rate limits and abuse paths.
7. Verify tests cover denial and malicious input paths.