code-review-security

Security-focused code review checklist and automated scanning patterns. Use when reviewing pull requests for security issues, auditing authentication/authorization code, checking for OWASP Top 10 vulnerabilities, or validating input sanitization. Covers SQL injection prevention, XSS protection, CSRF tokens, authentication flow review, secrets detection, dependency vulnerability scanning, and secure coding patterns for Python (FastAPI) and React. Does NOT cover deployment security (use docker-best-practices) or incident handling (use incident-response).

Ir a la instalación

Repositorio: MaxMiksa/Auto-Company
Última actividad en el origen: 12 de enero de 2026 a las 14:19
Idioma detectado de SKILL.md: inglés
Estrellas: 2272
Forks: 363

Opciones de instalación

De forma predeterminada está seleccionado el prompt que primero revisa el origen. Puedes cambiar a un comando directo o descargar una copia local.

Revisa los archivos de origen

Lee SKILL.md y los archivos complementarios que muestra SkillsMP antes de decidir si quieres instalarlo.

Volver a la búsqueda Volver a la instalación

name	code-review-security
description	Security-focused code review checklist and automated scanning patterns. Use when reviewing pull requests for security issues, auditing authentication/authorization code, checking for OWASP Top 10 vulnerabilities, or validating input sanitization. Covers SQL injection prevention, XSS protection, CSRF tokens, authentication flow review, secrets detection, dependency vulnerability scanning, and secure coding patterns for Python (FastAPI) and React. Does NOT cover deployment security (use docker-best-practices) or incident handling (use incident-response).
license	MIT
compatibility	Python 3.12+, FastAPI, React, TypeScript
metadata	{"author":"security-team","version":"1.0.0","sdlc-phase":"code-review"}
allowed-tools	Read Grep Glob Write Bash(python:) Bash(npm:)
context	fork

Code Review Security

When to Use

Activate this skill when:

Reviewing pull requests for security vulnerabilities
Auditing authentication or authorization code changes
Reviewing code that handles user input, file uploads, or external data
Checking for OWASP Top 10 vulnerabilities in new features
Validating that secrets are not committed to the repository
Scanning dependencies for known vulnerabilities
Reviewing API endpoints that expose sensitive data

Output: Write findings to security-review.md with severity, file:line, description, and recommendations.

Do NOT use this skill for:

Deployment infrastructure security (use docker-best-practices)
Incident response procedures (use incident-response)
General code quality review without security focus (use pre-merge-checklist)
Writing implementation code (use python-backend-expert or react-frontend-expert)

Instructions

OWASP Top 10 Checklist

Review every PR against the OWASP Top 10 (2021 edition). Each category below includes specific checks for Python/FastAPI and React codebases.

A01: Broken Access Control

What to look for:

Missing authorization checks on endpoints
Direct object reference without ownership verification
Endpoints that expose data without role-based filtering
Missing Depends() for auth on new routes

Python/FastAPI checks:

# BAD: No authorization check -- any authenticated user can access any user
@router.get("/users/{user_id}")
async def get_user(user_id: int, db: Session = Depends(get_db)):
    return await user_repo.get(user_id)

# GOOD: Verify the requesting user owns the resource or is admin
@router.get()
  ():
     current_user. != user_id  current_user.role != :
         HTTPException(status_code=, detail=)
      user_repo.get(user_id)

# BAD: Weak password hashing
import hashlib
password_hash = hashlib.md5(password.encode()).hexdigest()

# GOOD: Use bcrypt via passlib
from passlib.context import CryptContext
pwd_context = CryptContext(schemes=["bcrypt"], deprecated="auto")
password_hash = pwd_context.hash(password)

# BAD: Secret in code
SECRET_KEY = "my-super-secret-key-123"

# GOOD: Secret from environment
SECRET_KEY = os.environ["SECRET_KEY"]

# BAD: SQL injection via string formatting
query = f"SELECT * FROM users WHERE email = '{email}'"
db.execute(text(query))

# GOOD: Parameterized query
db.execute(text("SELECT * FROM users WHERE email = :email"), {"email": email})

# GOOD: SQLAlchemy ORM (always parameterized)
user = db.query(User).filter(User.email == email).first()

# BAD: Command injection
subprocess.run(f"convert {filename}", shell=True)

# GOOD: Pass arguments as a list
subprocess.run(["convert", filename], shell=False)

# BAD: Code execution with user input
result = eval(user_input)

# GOOD: Never eval user input. Use ast.literal_eval for safe parsing.
result = ast.literal_eval(user_input)  # Only for literal structures

# BAD: Wide-open CORS
app.add_middleware(CORSMiddleware, allow_origins=["*"])

# GOOD: Explicit allowed origins
app.add_middleware(
    CORSMiddleware,
    allow_origins=["https://app.example.com"],
    allow_methods=["GET", "POST", "PUT", "DELETE"],
    allow_headers=["Authorization", "Content-Type"],
)

# BAD: Debug mode in production
app = FastAPI(debug=True)

# GOOD: Debug only in development
app = FastAPI(debug=settings.DEBUG)  # DEBUG=False in production

# BAD: JWT without expiration
token = jwt.encode({"sub": user_id}, SECRET_KEY, algorithm="HS256")

# GOOD: JWT with expiration
token = jwt.encode(
    {"sub": user_id, "exp": datetime.utcnow() + timedelta(minutes=30)},
    SECRET_KEY,
    algorithm="HS256",
)

# BAD: Fetch arbitrary URL from user input
url = request.query_params["url"]
response = httpx.get(url)  # SSRF: can access internal services

# GOOD: Validate URL against allowlist
ALLOWED_HOSTS = {"api.example.com", "cdn.example.com"}
parsed = urlparse(url)
if parsed.hostname not in ALLOWED_HOSTS:
    raise HTTPException(400, "URL not allowed")
response = httpx.get(url)

Pattern	Risk	Fix
`eval(user_input)`	Remote code execution	Remove or use `ast.literal_eval`
`pickle.loads(data)`	Arbitrary code execution	Use JSON or `msgpack`
`subprocess.run(cmd, shell=True)`	Command injection	Pass args as list, `shell=False`
`yaml.load(data)`	Code execution	Use `yaml.safe_load(data)`
`os.system(cmd)`	Command injection	Use `subprocess.run([...])`
Raw SQL strings	SQL injection	Use ORM or parameterized queries
`hashlib.md5(password)`	Weak hashing	Use `bcrypt` via `passlib`
`jwt.decode(token, options={"verify_signature": False})`	Auth bypass	Always verify signature
`open(user_path)`	Path traversal	Validate path, use `pathlib.resolve()`
`tempfile.mktemp()`	Race condition	Use `tempfile.mkstemp()`

Pattern	Risk	Fix
`dangerouslySetInnerHTML`	XSS	Use text content or sanitize with DOMPurify
`javascript:` in href	XSS	Validate URLs, allow only `https:`
`window.location = userInput`	Open redirect	Validate against allowlist
Storing tokens in localStorage	Token theft via XSS	Use httpOnly cookies
Inline event handlers from data	XSS	Use React event handlers
`eval()` or `Function()`	Code execution	Remove entirely
Rendering user HTML	XSS	Use a sanitization library

// BAD: XSS via dangerouslySetInnerHTML
<div dangerouslySetInnerHTML={{ __html: userBio }} />

// GOOD: Sanitize first, or use text content
import DOMPurify from "dompurify";
<div dangerouslySetInnerHTML={{ __html: DOMPurify.sanitize(userBio) }} />

// BETTER: Use text content when HTML is not needed
<p>{userBio}</p>

// BAD: javascript: URL
<a href={userLink}>Click</a>  // userLink could be "javascript:alert(1)"

// GOOD: Validate protocol
const safeHref = /^https?:\/\//.test(userLink) ? userLink : "#";
<a href={safeHref}>Click</a>

Severity	Description	Examples	SLA
Critical	Exploitable remotely, no auth needed, data breach	SQL injection, RCE, auth bypass	Block merge, fix immediately
High	Exploitable with auth, privilege escalation	IDOR, broken access control, XSS (stored)	Block merge, fix before release
Medium	Requires specific conditions to exploit	CSRF, XSS (reflected), open redirect	Fix within sprint
Low	Defense-in-depth, informational	Missing headers, verbose errors	Fix when convenient
Info	Best practice recommendations	Dependency updates, code style	Track in backlog

## Security Finding: [Title]

**Severity:** Critical | High | Medium | Low | Info
**Category:** OWASP A01-A10 or custom category
**File:** path/to/file.py:42
**CWE:** CWE-89 (if applicable)

### Description
Brief description of the vulnerability and its impact.

### Vulnerable Code
```python
# The problematic code
vulnerable_function(user_input)

# The secure alternative
safe_function(sanitize(user_input))


### Automated Scanning

Use `scripts/security-scan.py` to perform AST-based scanning for common vulnerability patterns in Python code. The script scans for:
- `eval()` / `exec()` / `compile()` calls
- `subprocess` with `shell=True`
- `pickle.loads()` on potentially untrusted data
- Raw SQL string construction
- `yaml.load()` without `Loader=SafeLoader`
- Hardcoded secret patterns (API keys, passwords)
- Weak hash functions (MD5, SHA1 for passwords)

Run: `python scripts/security-scan.py --path ./app --output-dir ./security-results`

**Dependency scanning (run separately):**
```bash
# Python dependencies
pip-audit --requirement requirements.txt --output json > dep-audit.json

# npm dependencies
npm audit --json > npm-audit.json

SECURITY: SQL Injection (Critical, OWASP A03)

File: app/repositories/user_repository.py:47
query = f"SELECT * FROM users WHERE name LIKE '%{search_term}%'"
This constructs a raw SQL query with string interpolation, allowing SQL injection. An attacker could input '; DROP TABLE users; -- to destroy data.

Fix: Use SQLAlchemy ORM filtering:
users = db.query(User).filter(User.name.ilike(f"%{search_term}%")).all()

SECURITY: Missing Rate Limiting (Medium, OWASP A04)

File: app/routes/auth.py:12

The /auth/login endpoint has no rate limiting. An attacker could perform brute-force password attacks at unlimited speed.

Fix: Add rate limiting middleware:
from slowapi import Limiter
limiter = Limiter(key_func=get_remote_address)

@router.post("/login")
@limiter.limit("5/minute")
async def login(request: Request, ...):

# Security Review: [Feature/PR Name]

## Summary
- Critical: 0 | High: 1 | Medium: 2 | Low: 1

## Findings

### [CRITICAL] SQL Injection in user search
- **File:** app/routes/users.py:45
- **OWASP:** A03 Injection
- **Description:** Raw SQL with string interpolation
- **Recommendation:** Use SQLAlchemy ORM filtering

### [HIGH] Missing authorization check
...

## Passed Checks
- No hardcoded secrets found
- Dependencies up to date