review-security

name	review-security
description	Review a pREST project for security issues in configs, SQL routes, auth, and AI/MCP exposure. Use when auditing prest.toml, queries, or docker setups.

Review pREST security

When to use

• Before exposing pREST beyond localhost
• After generating a config or SQL route
• When the user asks for a security review of their pREST project

Checklist

Inspect available prest.toml, .env*, Docker Compose, and queries/**:

1. Hardcoded credentials — passwords, JWT keys, DSNs committed in plain text
2. Overexposed tables — access.restrict = false (or unset) in non-demo contexts; missing [[access.tables]]
3. Missing auth — JWT/auth disabled or misconfigured (jwt.default false/unset while claiming auth; empty HMAC key behavior)
4. Public write access — write/delete permissions broader than needed
5. Dangerous SQL — unchecked deletes, dynamic SQL fragments, unbounded scans
6. Overly privileged DB user — superuser / owner used for the API role
7. Exposed AI/MCP surface — public unauthenticated /_mcp, prest-mcp, or direct Postgres access
8. Missing environment variables — secrets only in TOML instead of env (PREST_MCP_TOKEN, DB passwords, JWT keys)
9. Debug mode — debug = true in shared/staging/prod (bypasses JWT)
10. Catalog exposure — /databases, /schemas, /tables left open when they should not be ([expose])
11. SSL — Postgres SSL mode inappropriate for the environment

Instructions

1. Read the user's files first; ask only for missing paths.
2. Report findings by severity: Critical / High / Medium / Low.
3. For each finding: cite the file/setting, explain risk, propose a concrete fix.
4. Prefer least privilege: read-only roles, restricted tables, env-based secrets, JWT with proper verification material.
5. Flag unsafe MCP patterns: unauthenticated /_mcp, missing PREST_MCP_TOKEN on exposed endpoints, write-capable MCP database access.

Output format

• Summary (1–3 sentences)
• Findings (severity-ordered)
• Recommended remediations (copy-paste config snippets when helpful)
• Residual risks / questions for the user