| name | security-review |
| description | Use when security review checklist for diffs touching auth, authorization, input handling, secrets, uploads, payments, PII, dependencies, CORS, or unsafe HTML. Use only when security-sensitive code or configuration changed. |
Security Review Skill
Adapted from ECC's security-review skill (MIT).
This skill ensures all code follows security best practices and identifies potential vulnerabilities.
When to Activate
- Implementing authentication or authorization
- Handling user input or file uploads
- Creating new API endpoints
- Working with secrets or credentials
- Implementing payment features
- Storing or transmitting sensitive data
- Integrating third-party APIs
See REFERENCE.md for full security checklist with code examples (secrets, input validation, SQL injection, auth, XSS, CSRF, rate limiting, data exposure, blockchain, dependencies) and security testing patterns.
Pre-Deployment Security Checklist
Before ANY production deployment:
Resources
Remember: Security is not optional. One vulnerability can compromise the entire platform. When in doubt, err on the side of caution.
