Security Review

Overview

Security is not a feature — it's a property of the entire system. Review security boundaries systematically, not ad-hoc.

When to Use

• Authentication, authorization, session management code
• Any user input that touches storage, commands, or rendering
• Secrets, credentials, API keys in code or config
• Before a security-sensitive feature ships
• After any change to auth flows or data access controls

OWASP Top 10 Checklist

Work through these for every security-relevant code change: