| name | security-review |
| description | Use for secrets handling, workflows, server / Supabase / API routes, environment variables, GitHub secret-scanning remediation, and any PR that touches the security boundary. |
| when_to_use | ["Adding / changing an API route","Touching Supabase access patterns","Editing workflows that reference secrets","Reviewing `.env.example` changes","Triaging a secret-scanning alert"] |
| related_files | ["server/**","supabase/**",".github/workflows/**",".env.example","docs/SECURITY_NOTES.md","docs/environment-variables.md"] |
| related_prompts | [".github/prompts/pr-review.prompt.md",".github/prompts/backend-admin-supabase.prompt.md"] |
Skill: Security Review
Public repo, public site, public X channel. Security failures are public failures.
Threat model (top 6)
- Secret in git history (commit, fixture, doc, screenshot)
- Service-role Supabase key in browser bundle
- Unauthenticated / under-authenticated admin route
- Missing input validation → injection / SSRF / path traversal
- Workflow logs leaking secrets (via
set -x, env | sort, echo)
- Dependency CVE in production package
Workflow
- Diff scan: search the diff for secret-like strings (
key, secret, token, password,
webhook, service_role).
- Env scan: any new env var documented in
.env.example + docs/environment-variables.md?
- Auth scan: any new route — auth applied? Rate limit applied? Input validated?
- Browser bundle scan:
npm run build → grep dist/ for SERVICE_ROLE_KEY, STRIPE_SECRET,
JWT_SECRET, etc.
- Workflow scan: any
set -x or env | sort near ${{ secrets.* }}?
- Dependency scan:
gh-advisory-database on any added dep; npm audit for HIGH/CRITICAL.
- Report findings as Blocking / Important / Nice-to-have.
Checklists in this skill
Common mistakes
- Real-looking placeholders in
.env.example that someone copy-pastes into prod.
- Returning
err.message directly to the client (info leak).
- Trusting
X-Forwarded-For without configuring app.set('trust proxy', ...) correctly.
VITE_SUPABASE_SERVICE_ROLE_KEY — never a thing.- Webhook handler that doesn't verify the signature.
See .github/instructions/security.instructions.md.
