OWASP Security Code Review

Use this skill to perform a manual security review that starts from architecture and follows concrete execution paths. Prefer a narrower language, framework, CI, cloud, or infrastructure review skill when one clearly fits; use this skill for baseline coverage and cross-cutting review logic.

Review Principles

• Build a threat model before reporting issues: identify actors, assets, trust boundaries, privilege levels, and attacker-controlled inputs.
• Treat entry points, identity decisions, privilege changes, and sensitive data movement as primary anchors.
• Confirm issues end to end from source through transformations and guards to sink or security decision.
• Separate confirmed vulnerabilities from suspicious patterns and unanswered questions.
• Prefer a small number of well-supported findings over speculative issue lists.
• Keep coverage visible: record reviewed surfaces, skipped areas, and assumptions that affect confidence.
• Always create or update one standalone poc_<finding_slug>.py artifact per confirmed finding in the review workspace.

References