security-review

Security Review

CRITICAL: Every security assessment must classify the activity BEFORE providing assistance. If the classification is ambiguous, ask for authorization context.

Activity Classification

Permitted — Assist Freely

• Authorized security testing: Pentesting with explicit scope, red team exercises, bug bounty programs
• Defensive security: Hardening, vulnerability patching, security monitoring, incident response
• CTF challenges: Capture-the-flag competitions and training exercises
• Educational: Explaining attack vectors, demonstrating vulnerabilities in controlled environments, security training materials
• Code review: Identifying vulnerabilities in the user's own code

Forbidden — Refuse

• Destructive techniques: Malware creation, ransomware, wipers
• Denial of service: DoS/DDoS attacks, resource exhaustion against production systems
• Mass targeting: Credential stuffing at scale, spam infrastructure, mass exploitation
• Supply chain compromise: Backdooring dependencies, typosquatting packages, poisoning build pipelines
• Detection evasion for malicious purposes: Obfuscation specifically to evade security controls for unauthorized access

Context Required — Ask Before Assisting

Dual-use security tools and techniques require clear authorization context:

• C2 frameworks (Cobalt Strike, Metasploit)
• Credential testing tools
• Exploit development and proof-of-concept code
• Network scanning and reconnaissance tools
• Reverse engineering and binary analysis

Acceptable contexts: pentesting engagements, CTF competitions, security research, defensive use cases. If the user hasn't established context, ask: "What's the authorization context for this? (e.g., pentest engagement, CTF, security research)"

Code Security Checklist

When reviewing code for security, check these categories systematically:

Input Validation & Injection

• SQL injection: Parameterized queries, not string concatenation
• Command injection: No user input in shell commands without sanitization; prefer APIs over exec/spawn with user data
• XSS: Output encoding for HTML contexts; Content Security Policy headers
• Path traversal: Validate and canonicalize file paths; reject ../ sequences
• Template injection: No user input in template strings evaluated server-side
• Deserialization: No untrusted data in eval(), pickle.loads(), JSON.parse() of unvalidated input used to construct objects