name	csa-security
description	Adversarial security analysis expertise for identifying vulnerabilities before attackers do
allowed-tools	Bash, Read, Grep, Glob

Security Audit & Code Review

Adversarial security analysis expertise for identifying vulnerabilities before attackers do.

Core Principle: Assume All Input Is Malicious

For every code path:

If I were an attacker, how would I exploit this?
Can I exhaust system resources (memory/CPU/disk/connections)?
Can I bypass business logic constraints?

Security Review Dimensions

Dimension	Checks
Panic/DoS	`unwrap()`, array bounds, division by zero, stack overflow, integer overflow
Resource Exhaustion	Unbounded loops, unlimited memory allocation, connection pool depletion
Race Conditions	TOCTOU, double-spend attacks, non-atomic operations, concurrent access bugs
Injection Attacks	SQL injection, command injection, XSS, path traversal, deserialization
Auth/Authz	Permission bypass, session fixation, credential leakage, privilege escalation
Cryptography	Weak randomness, timing attacks, plaintext storage, hardcoded secrets
Business Logic	Negative amounts, integer overflow, state machine bypass, double-processing

Domain-Specific Checklists

Financial/Payment Systems

Use fixed-point (NOT floating-point) for amounts
All operations use database transactions
Idempotency design (prevent replay attacks)
Balance check and deduction atomic execution
Decimal precision matches business rules

User Input Processing

Input length limits enforced
Character set whitelist (reject unexpected chars)
Parameterized queries (prevent SQL injection)
Output encoding (prevent XSS)
Path canonicalization (prevent traversal)

Async/Concurrency

No data races
Deadlock risks documented and eliminated
Memory ordering correct (Acquire/Release/SeqCst)
Cancellation safety verified

Report Format

# Security Review: {Module Name}

**Risk Level**: [Critical / High / Medium / Low]

## Findings

### [Critical] SEC-001: {Title}
**Location**: `path/to/file.rs:123`
**Type**: {Panic DoS / Resource Exhaustion / Race Condition / ...}
**Description**: {Detailed vulnerability description}
**Suggested Fix**: {Code example}

## Priority Action Plan
1. **Immediate**: Critical/High issues
2. **Short-term**: Medium issues
3. **Long-term**: Low issues