security-review-process
Installation
SKILL.md
Security Review Process
Security Gates & Quick Reference
| Area | Gate |
|---|---|
| Input Validation | Untrusted payloads must pass an allowlist filter before processing |
| Secrets | NO secrets may be committed or logged |
| Injections | Direct SQL interpolation (#{id}) is FORBIDDEN |
| Dependencies | Run bundle-audit before finalizing changes |
Process Steps
Step 1: Input Validation Audit
- Identify all entry points (controllers, API endpoints, webhooks, console runners).
- Verify every parameter is explicitly allowlisted and type-coerced if necessary.
- Ensure instruction-like keys (e.g.
prompt,instructions) in JSON payloads are discarded or neutralized.