security-review

name	security-review
description	Use when: review code or a design for security issues across the OWASP Top 10 and common pitfalls.

Goal: find and fix security flaws before they ship.

Use for:

• reviewing a feature, endpoint, or design for risk
• auditing input handling, auth, and data exposure
• hardening code against common attacks

Workflow:

1. Map the trust boundaries and where untrusted data enters.
2. Check input validation and output encoding at each boundary.
3. Verify authentication and authorization on every path.
4. Look for injection: SQL, command, template, and XSS.
5. Check secrets handling, crypto use, and data exposure.
6. Confirm dependencies are current and known-good.

OWASP focus:

• broken access control and IDOR
• injection and unsafe deserialization
• security misconfiguration and verbose errors
• sensitive data exposure and weak crypto

Rules:

• never trust client input; validate and encode
• enforce authorization server-side at the data layer
• use parameterized queries and safe APIs, always
• keep secrets out of code, logs, and error messages