Reviewing Security

Overview

Most security review output is worthless because it names categories instead of paths. "Validate all user input" is true of every program ever written and changes nothing. A useful finding is a path: an input an attacker controls, the code that carries it, the operation it reaches, and what the attacker gets.

Core principle: Follow the data, not a checklist. Vulnerabilities live in the gap between where a value enters and where it acts.

Companion skills: requesting-code-review for the general review loop, systematic-debugging when confirming an exploit path.

The Iron Law

NO FINDING WITHOUT A PATH FROM ATTACKER-CONTROLLED INPUT TO IMPACT

If you cannot name the input, the route it takes, and what it costs the operator, you have a code smell — file it under Observations, not Findings. Padding a report with categorical advice buries the one path that is real.

The corollary: trace the path in the actual code before reporting it. A grep hit is a lead, not a finding.