Security Review

This skill ensures all code follows security best practices and identifies potential vulnerabilities.

vs security-scan: This skill audits code patterns — authentication, input validation, secrets handling, SQL injection, XSS, CSRF, OWASP Top 10. Use security-scan when you need to audit your Claude Code configuration (.claude/settings.json, hooks, MCP configs, CLAUDE.md) for injection risks.

When to Activate

• Implementing authentication or authorization (JWT, OAuth, session management)
• Handling user input — form fields, file uploads, query parameters, JSON payloads
• Creating new API endpoints that accept external data
• Working with secrets, credentials, or API keys in code or configuration
• Implementing payment processing or financial transaction logic
• Storing or transmitting PII, health data, or other sensitive user data
• Integrating third-party APIs that receive or return sensitive data
• Writing SQL queries or ORM calls that include user-provided values

Security Checklist