claude-security-engineer

Full pre-ship security review that runs all ten OWASP Top 10 checks in sequence. Use before any significant feature ships to production.

Checks for server-side request forgery risk before any code that makes outbound HTTP requests based on user-supplied URLs or parameters is written or modified.

Requires structured security event logging before any authentication, authorization, or sensitive data access code ships.

Checks deserialization safety, CI/CD pipeline integrity, and dependency integrity before any code that deserializes objects or executes pipeline scripts is written or modified.

Enforces secure authentication patterns before any login, session, token, or credential management code is written or modified.

Checks CVE status, license compatibility, and maintenance health of any new dependency before it enters the codebase.

Checks for insecure default settings, exposed debug endpoints, permissive CORS, open cloud storage, and missing security headers before any configuration or deployment code ships.

Requires a threat model before any new user-facing feature, authentication flow, or data handling system is designed or modified.

Scans all code that constructs queries, commands, or markup from user input, blocking SQL injection, command injection, LDAP injection, and XSS before the code ships.

Checks for weak or missing encryption before any code handling passwords, tokens, PII, or sensitive data is written or modified.

Checks authorization enforcement before any route, endpoint, or data access code is written or modified. Catches missing auth checks, IDOR patterns, and privilege escalation paths.