security-review

Security Review

This skill operationalises the OWASP mandate in this harness's own instructions: "Ensure your code is free from security vulnerabilities outlined in the OWASP Top 10." Work through this checklist for every production-tier code review; prioritise findings as P0 (must fix before merge) or P1 (fix within the sprint).

External reference: OWASP Top 10 (2021).

---

A01 — Broken Access Control

What to look for: Missing authentication checks, insecure direct object references (IDOR), privilege escalation paths, CORS misconfiguration.

# WRONG: fetches any record by ID — no ownership check
def get_document(doc_id: int) -> Document:
    return db.query(Document).filter_by(id=doc_id).first()

# RIGHT: scope to the authenticated user
def get_document(doc_id: int, current_user: User) -> Document:
    doc = db.query(Document).filter_by(id=doc_id, owner_id=current_user.id).first()
    if doc is None:
        raise NotFoundError()
    return doc

Checklist:

• Every route/handler checks that the caller owns or is permitted to access the resource it requests.
• Admin/privileged endpoints require an explicit role check, not just authentication.
• CORS Access-Control-Allow-Origin: * is not set on endpoints that return sensitive data.

---

A02 — Cryptographic Failures

What to look for: Hardcoded secrets, weak algorithms (MD5, SHA-1, DES), HTTP instead of HTTPS for sensitive data, secrets logged.

# WRONG: hardcoded API key and weak hashing
API_KEY = "sk-12345abcde"
password_hash = hashlib.md5(password.encode()).hexdigest()

# RIGHT: key from environment; use bcrypt/argon2 for passwords
import os, bcrypt
API_KEY = os.environ["OPENAI_API_KEY"]
password_hash = bcrypt.hashpw(password.encode(), bcrypt.gensalt())

Checklist:

• No credentials, tokens, or private keys in source code or committed config files. Use .env + .env.sample pattern.
• Password storage uses bcrypt, argon2, or scrypt — never MD5/SHA-1.
• Sensitive data transmitted only over TLS; no HTTP fallback for auth.