security-review

Security Review Skill

This skill ensures all code follows security best practices and identifies potential vulnerabilities before they reach production.

Design Philosophy

Security is not optional. This skill acts as a security quality gate that validates code against common vulnerability patterns (OWASP Top 10) and project-specific security requirements. One vulnerability can compromise the entire platform.

When to Activate

Trigger this skill when code involves:

• Authentication or authorization - Login flows, session management, role checks
• User input handling - Forms, query parameters, file uploads
• API endpoints - New routes, especially public-facing
• Secrets or credentials - API keys, database connections, tokens
• Payment features - Financial transactions, billing, subscriptions
• Sensitive data - PII, health data, financial records
• Third-party API integration - External service connections
• Database queries - Especially raw SQL or dynamic queries

Security Checklist

1. Secrets Management

BAD - Never Do This

const apiKey = "sk-proj-xxxxx"  // Hardcoded secret
const dbPassword = "password123" // In source code
const config = {
  stripe_key: "sk_live_xxxxx"  // Committed to repo
}

GOOD - Always Do This

const apiKey = process.env.OPENAI_API_KEY
const dbUrl = process.env.DATABASE_URL

// Verify secrets exist at startup
if (!apiKey) {
  throw new Error('OPENAI_API_KEY not configured')
}

// Use secret management services for production
// AWS Secrets Manager, HashiCorp Vault, etc.

Verification Checklist

• No hardcoded API keys, tokens, or passwords in source
• All secrets loaded from environment variables
• .env, .env.local, .env.production in .gitignore
• No secrets in git history (run git log -p | grep -i "api_key\|secret\|password")
• Production secrets in secure secret management (Vercel, Railway, AWS SM)
• Different secrets for dev/staging/production environments