security

name	security
description	Audit code and workflows for practical security issues including auth flaws, injection risk, insecure defaults, data exposure, and secrets handling.

Security

Use this for feature reviews, auth flows, API endpoints, config audits, and pre-release hardening.

Checklist

• Authentication and authorization correctness.
• Input validation and output encoding.
• Injection risk: SQL, command, template, HTML, path traversal.
• Secret handling, token leakage, verbose logs.
• Session, cookie, CSRF, CORS, and redirect handling.
• Unsafe file upload/download behavior.
• Dependency and config risk.

Workflow

1. Map trust boundaries.
2. Identify external inputs and privileged actions.
3. Check authorization at the actual execution point.
4. Check data exposure in logs, errors, traces, and client responses.
5. Identify exploit path, impact, and fix.

Output format

• Findings by severity
• Exploit scenario
• Fix recommendation
• Validation steps