audit-skills

Full security, correctness, and operability audit of code. Use when reviewing a diff, endpoint, or feature for vulnerabilities or bugs without a specific topic in mind — security review, audit, code review for safety, "check this for issues".

Inbound token and webhook verification checklist. Use when code verifies JWTs, API keys, signed URLs, or webhook signatures — decode-without-verify, alg confusion, missing exp/aud/iss checks, kid/JWKS handling, HMAC over raw body, replay windows.

Insecure deserialization checklist. Use when untrusted bytes (request bodies, cookies, sessions, cache entries, queue messages, uploaded files) are deserialized — native object deserializers, polymorphic JSON/XML typing, unsafe YAML, or missing type allowlists.

Time, timezone, and clock-correctness checklist. Use when code stores or computes timestamps, durations, timeouts, or expiry — naive vs aware datetimes, server-local now(), wall-clock for elapsed time, DST and calendar math, cross-zone comparisons.

Caching correctness checklist. Use when reviewing caches — keys missing a user/tenant dimension, stale data after writes, cache stampede, cached errors, or per-user responses landing in a shared or CDN cache.

Numeric and money precision checklist. Use when code computes money, totals, taxes, or splits — float used for currency, ad hoc rounding, integer overflow, division remainders, or unit/currency mismatches.

Query cardinality checklist. Use when an UPDATE or DELETE keys on a non-unique column (e.g. WHERE name = ?) and may hit the wrong rows, when findOne/.single()/.first() runs on a non-unique field, or when a column is treated as unique in app code without a database UNIQUE constraint.

Input validation and API contract checklist. Use when reviewing request validation, DTOs, public endpoints, types, bounds, or unknown-field handling.

Transactional-integrity checklist. Use when one operation writes to multiple tables, stores, or external systems and partial failure would corrupt state.

Authentication and session audit checklist. Use when reviewing login, logout, password reset, token issuance, session expiry, or remember-me flows.

Access-control audit checklist. Use when reviewing endpoints or handlers that gate actions by role, permission, or ownership, or when checking for privilege escalation.

Background job and queue checklist. Use when reviewing async jobs, scheduled tasks, or consumers — retries, poison messages, ordering, timeouts.

Blocking I/O in async contexts checklist. Use when reviewing async/await code, event-loop or reactor-based services, coroutines, or worker/thread pools — sync calls in async handlers, CPU work on the event loop, sync-over-async, blocking sleeps, missing timeouts.

Insecure-configuration checklist. Use when reviewing app config, CORS, security headers, debug flags, cookies, or environment-specific settings.

Cryptography and data-protection checklist. Use when code hashes passwords, encrypts data, generates tokens or randomness, or compares secrets.

Cross-site request forgery checklist. Use when reviewing state-changing endpoints in apps with cookie or session-based authentication — CSRF tokens, SameSite, origin checks. Does not apply to pure token-based APIs.

Data over-exposure checklist. Use when reviewing API responses, serializers, error messages, or logs for leaked fields, PII, or internal details.

Discarded async work checklist (fire-and-forget). Use when reviewing code that creates promises, futures, tasks, or reactive publishers (Mono/Flux) — results not awaited, returned, or composed; bare subscribe; floating promises; async writes that silently never run.

Exception and error-handling audit checklist. Use when reviewing try/catch blocks, error propagation, empty or overly broad catches, rethrowing, cleanup/finally paths, async error handling, or whether errors map to the right HTTP status (404 vs 403, 401, 422, 409).

File upload/download safety checklist. Use when code accepts, stores, processes, or serves files — path traversal, type and size limits, storage location.

Safe-retry and duplicate-delivery checklist. Use when reviewing payments, webhooks, queue consumers, emails, or any handler that may execute twice.

Insecure direct object reference checklist. Use when code fetches or mutates a resource using an ID, slug, UUID, or filename taken from the request.

Injection audit checklist (SQL, NoSQL, command, template, path). Use when queries, shell commands, templates, or paths are built from user input.

Mass-assignment checklist. Use when request payloads are bound onto models or entities — create/update/fill from the request body, fillable/guarded lists, strong params, DTO binding, or fields like role, is_admin, or owner_id being writable.

Zero-downtime migration checklist. Use when reviewing database migrations or schema changes — locks, backfills, destructive changes, rollback plans.

Query-amplification (N+1) checklist. Use when code loads related data inside a loop over a collection, or when reviewing ORM-heavy read paths for performance.

Observability checklist. Use when checking whether errors, slow paths, or new endpoints would be visible in production — logging, metrics, tracing, alerts.

Output encoding and XSS checklist. Use when user-controlled data is rendered into HTML, JavaScript, CSS, URLs, headers, or emails.

Parser/validator differential checklist. Use when reviewing validators, regexes, allowlists, URL or path parsing, content-type checks, or normalization — inputs a gate accepts but the downstream consumer interprets differently (unanchored regexes, startswith allowlists, two URL parsers, validate-then-reparse).

Resource-exhaustion checklist. Use when reviewing endpoints for missing pagination, unbounded loops over input, missing size or rate limits, or regex backtracking.

Database schema design checklist (indexes, foreign keys, constraints). Use when reviewing migrations, new tables or columns, slow queries, missing indexes, foreign-key and ON DELETE behavior, or integrity rules enforced only in app code.

Secrets-handling checklist. Use when reviewing code or config touching API keys, credentials, or tokens — hardcoding, logging, committing, rotation.

Server-side request forgery checklist (includes open redirects). Use when code makes network requests to URLs, hosts, or IPs derived from user input — webhooks, fetchers, URL previews, importers.

Shared and concurrent state checklist. Use when reviewing code with shared mutable state, caching, counters, or check-then-act sequences (race conditions).

Statelessness checklist for horizontally scaled apps. Use when reviewing services meant to run as multiple replicas — in-memory sessions or counters, module/static mutable state, local-disk uploads, process-local locks or schedulers, sticky-session assumptions, state lost on deploy.

Multi-tenant isolation checklist. Use when reviewing queries, caches, or background jobs in a multi-tenant app for cross-tenant data leakage — tenant scoping, shared cache keys.

Remediation patterns for correctness findings. Use after a confirmed atomicity, idempotency, or background-work issue — transactions, idempotency keys, outbox.

Remediation patterns for authorization findings. Use after an audit confirms an authz or IDOR issue and the user asks for a fix — policy checks, ownership scoping.

Remediation patterns for observability gaps. Use when adding logging, metrics, or tracing after an audit finds blind spots.