Secure Code Review Skill

Purpose

Establish security-focused code review practices across all Hack23 projects, ensuring security vulnerabilities, insecure patterns, and compliance violations are identified and remediated before code reaches production.

Rules

Review Requirements

MUST:

• Review all code changes for security implications before merging
• Use automated security scanning (CodeQL, Dependabot) as first line of defense
• Check for OWASP Top 10 vulnerabilities in every review
• Verify proper input validation and output encoding
• Confirm no secrets, credentials, or keys in code or configuration
• Validate proper error handling (no information leakage)
• Check authorization controls on new endpoints or resources
• Verify proper use of cryptographic functions