Security Review — Anti-Patterns

This skill extends security-review with common security mistakes and how to fix them. Load security-review first.

When to Activate

• JWT or session tokens stored in localStorage (XSS risk)
• API endpoints rely on frontend UI hiding buttons instead of server-side permission checks
• Error handlers return error.stack or raw database error messages to clients
• Input validation uses replace() to strip known bad strings (blacklist pattern)
• CI pipelines use npm install instead of npm ci

Anti-Patterns

Storing Tokens in localStorage

Wrong: