security-review

name	security-review
description	Security checklist for auth, input, secrets, and dangerous sinks.

Security Review

When

Auth, user input, file/network sinks, crypto, payments, admin tools.

Checklist

1. Secrets only from env/secret manager; never committed.
2. Parameterized queries; no shell interpolation of user data.
3. Authz on every sensitive operation (not just UI hide).
4. SSRF: block link-local, metadata IPs, file:// unless required.
5. Upload/path: basename + allowlist; store outside web root.
6. CSRF on cookie-session state changes.
7. Rate limit auth and expensive endpoints.
8. Safe defaults on new flags.

Output

Finding list with path, impact, fix. If secret leaked: rotation steps first.