Performing Security Code Review

Overview

Conducts security-focused code reviews by scanning source files for common vulnerability patterns including SQL injection, XSS, authentication flaws, insecure dependencies, and secret exposure. Produces structured severity-rated reports with specific remediation guidance.

Prerequisites

• Read access to all source files in the target project
• grep available on PATH for pattern matching
• Access to package.json or equivalent dependency manifest for dependency auditing
• Familiarity with OWASP Top 10 vulnerability categories

Instructions

1. Identify the scope of the review: specific files, directories, or the entire codebase. Confirm the primary language(s) and framework(s) in use.
2. Scan for hardcoded secrets and credentials:
   • Search for patterns matching API keys, tokens, passwords, AWS access keys (AKIA...), and private key headers (BEGIN PRIVATE KEY).
   • Flag any .env files or configuration files containing plaintext secrets.
3. Analyze code for injection vulnerabilities: