security-review

name	security-review
description	Security analysis checklist aligned with OWASP Top 10
argument-hint	<scope-description>
user-invocable	true
allowed-tools	["Read","Grep","Glob","Bash"]

Security Review

Checklist (OWASP Top 10 2021)

A01 — Broken Access Control

• Authorization checked on every sensitive endpoint/operation
• Default deny — access requires explicit grant
• No path traversal, no direct object reference without auth check
• Rate limiting on authentication endpoints

A02 — Cryptographic Failures

• No secrets in source code, environment variables, or logs
• TLS for all external communication
• Strong hashing for passwords (bcrypt/argon2, not MD5/SHA1)