Security Review

When to use

Use this skill when a bounded chunk of code is being checked systematically for security and a report is the deliverable. It is the workflow; the patterns themselves live in secure-coding, where phase 4 hands off.

Activates on:

• A request like "do a security review on <PR/branch/feature/service>", "review this code for security issues", "audit against OWASP Top 10", "is this safe to merge", "security audit before production".
• A PR that touches auth, crypto, user-input handling, session management, PII storage, deserialization, file upload, or external integrations. Then reviewing is not optional.
• A new service before it goes live, or an existing one touched again after an incident.
• A quarterly or release-cycle audit of high-risk subsystems on an older codebase.

When NOT to use (handoff)