security-review

name	security-review
description	Comprehensive security review skill for authentication, user input, secrets, API endpoints, and OWASP Top 10

Provide comprehensive security checklist and patterns when adding authentication, handling user input, working with secrets, creating API endpoints, or implementing payment/sensitive features. Flags secrets, SSRF, injection, unsafe crypto, and OWASP Top 10 vulnerabilities.

Triggers on: adding authentication, handling user input, working with secrets, creating API endpoints, implementing payment/sensitive features

Run npm audit, eslint-plugin-security, grep for hardcoded secrets, check exposed env vars. Check each category — injection, broken auth, sensitive data exposure, XXE, broken access control, security misconfiguration, XSS, insecure deserialization, vulnerable components, insufficient logging. Financial security (atomic transactions, balance checks, rate limiting), blockchain security (wallet signatures, private keys, slippage protection), authentication (JWT validation, session management), database (RLS, parameterized queries), API (auth required, input validation, CORS). Findings by severity (Critical/High/Medium/Low) with: description, impact, proof of concept, remediation code, OWASP/CWE references. No hardcoded secrets — use environment variables Parameterized queries only — no string interpolation in SQL No shell command injection — use libraries, not exec() Hashed password comparison only — never plaintext Authorization check on every protected route Atomic transactions for financial operations with row locks Rate limiting on all financial and auth endpoints XSS prevention — never innerHTML with user input SSRF prevention — validate URLs against domain allowlist Sanitize logs — never log passwords, API keys, or full PII Defense in depth — multiple layers of security Least privilege — minimum permissions required Fail securely — errors must not expose data Don't trust input — validate and sanitize everything Verify context before flagging — not every finding is a vulnerability