security-review-playbook

name	security-review-playbook
description	Review systems for authentication and authorization gaps, secret handling problems, unsafe queries, insecure defaults, data exposure, dependency risk, and abuse paths. Use for code reviews, threat-focused audits, or pre-release security checks.

Security Review Playbook

Overview

Review systems with an attacker and defender mindset at the same time.

Core Workflow

1. Map trust boundaries, data flows, privileged actions, and externally reachable surfaces.
2. Check authentication, authorization, session handling, and access-control assumptions.
3. Inspect input handling, query construction, file access, redirects, deserialization, and unsafe execution paths.
4. Check secrets, logging, configuration defaults, dependency posture, and data exposure risks.
5. Report concrete findings by severity with exploit path, impact, and remediation guidance.

Deliver

• Focus on real vulnerabilities and meaningful hardening gaps.
• Note missing evidence separately from confirmed findings.
• Include operational or product follow-ups when fixes require them.

Guardrails

• Prefer primary evidence from code and config over hypothetical fear lists.
• Avoid exploit-detail overproduction when a safer summary is enough.
• Escalate broken access control, secret leakage, and unsafe defaults quickly.