| name | security-review |
| description | Security review checklists, threat model, severity classification, and supply chain verification for Go applications. Load when conducting security reviews. |
| compatibility | ["claude-code","opencode","github-copilot"] |
| metadata | {"version":"1.0","author":"team"} |
Core Security Principles
Security as Emergent Property
Security cannot be bolted on later. Verify that security considerations are present from initial design, not added as an afterthought.
Defense in Depth
Multiple overlapping controls. No single mechanism should be the only protection. Check for:
- Input validation at entry points AND internal processing
- TLS for transport AND credential protection at rest
- Timeout enforcement at multiple layers
Least Privilege
Grant minimal necessary permissions:
- Code accesses only required resources
- Credentials scoped to specific operations
- No unnecessary capabilities in container/service
Fail Secure
When errors occur, system should remain secure:
- Connection failures should not expose credentials
- Parsing errors should not bypass validation
- Resource exhaustion should not disable security checks
Security Checklist
Input Validation
Injection Prevention
Credential and Sensitive Data Handling
Network Security
Resource Management
Container/Deployment Security
Data Flow Constraints
Supply Chain Security
Go-Specific Security Checks
Concurrency Safety
Error Handling
Type Safety
Severity Classification
CRITICAL (BLOCKED)
- Credential exposure in logs or errors
- Remote code execution vectors
- Authentication bypass
- Unvalidated external input to sensitive operations
HIGH
- TLS validation disabled without justification
- Missing input validation on external data
- Resource exhaustion without bounds
- Data races in security-critical code
MEDIUM
- Sensitive data in verbose error messages
- Missing timeouts on network operations
- Overly permissive container configuration
- Audit logging gaps
LOW
- Information disclosure in health endpoints
- Missing rate limiting
- Verbose logging in production default
Supply Chain Verification
Automated Checks (via Makefile)
go mod verify
Verifies downloaded modules match go.sum checksums. Must pass. If it fails, the review is BLOCKED.
If govulncheck is available:
govulncheck ./...
Checks for known CVEs, reports if vulnerable code is actually called.
Manual Checks
After automated checks pass:
- Dependency inventory:
go list -m all
Review for unexpected packages, typosquatting, unknown sources.
govulncheck Output Interpretation
govulncheck reports vulnerabilities with two dimensions:
1. Reachability (reported by govulncheck):
- Called — vulnerable function is executed by your code
- Imported — package imported but vulnerable function not called
- Required — module in go.mod but vulnerable package not imported
2. CVE Severity (check vuln.go.dev for each vulnerability ID):
- CRITICAL, HIGH, MEDIUM, LOW per standard CVE scoring
Prioritization matrix:
| Reachability | + CRITICAL/HIGH CVE | + MEDIUM/LOW CVE |
|---|
| Called | Fix immediately | Fix this release |
| Imported | Fix this release | Fix when convenient |
| Required | Fix when convenient | Backlog |
