Security Review

Purpose and Intent

Audit code, configuration, logs, or datasets for sensitive-data and compliance risks across four areas, and report only concrete, evidence-based findings. This skill does not assume a specific language, framework, or regulatory jurisdiction beyond what is explicitly in scope.

Areas

Run each area below against the given scope. Skip an area only if it is clearly inapplicable (e.g. no health data anywhere in the project) and say so explicitly.

1. PII exposure — detect personally identifiable information (names, emails, phone numbers, national IDs, financial data, addresses) in logs, datasets, code, or outputs that shouldn't contain it; flag missing redaction/masking.
2. HIPAA technical safeguards — only when the scope involves health data (PHI): check for encryption at rest/in transit, access controls, and audit logging consistent with HIPAA's technical safeguard requirements.
3. Security compliance — general security posture: insecure defaults, missing authN/authZ checks, unsafe deserialization, injection risks, insecure transport, dependency/license risk flagged as a security concern.
4. Secret leak detection — hardcoded credentials, API keys, tokens, private keys in source code, config files, or git history.

When to Use