security-review

Security Review

Security vulnerability detection and remediation guidance for ultrawork verification.

What This Skill Provides

Comprehensive security checklists covering:

• OWASP Top 10 vulnerabilities
• Secrets and credential exposure
• Input validation and injection prevention
• Authentication and authorization patterns
• API security best practices

When to Use This Skill

ALWAYS review when code involves:

• User input handling
• Authentication or authorization
• Database queries
• API endpoints
• File uploads
• Payment/financial operations
• External API integrations
• Sensitive data (PII, credentials, tokens)

IMMEDIATELY review when:

• Production incident occurred
• Dependency has known CVE
• User reports security concern
• Before major releases

OWASP Top 10 Checklist

1. Injection (SQL, NoSQL, Command)

Checklist:

[ ] Queries use parameterization (no string concatenation)
[ ] ORMs used safely (no raw SQL strings)
[ ] User input is sanitized before queries
[ ] Command injection prevented (no shell execution with user input)
[ ] LDAP injection prevented
[ ] XPath injection prevented

Examples:

// ❌ CRITICAL: SQL injection vulnerability
const query = `SELECT * FROM users WHERE id = ${userId}`;
await db.query(query);

// ✅ CORRECT: Parameterized query
const { data } = await supabase
  .from('users')
  .select('*')
  .eq('id', userId);

// ❌ CRITICAL: Command injection
const { exec } = require('child_process');
exec(`ping ${userInput}`, callback);

// ✅ CORRECT: Use libraries instead
const dns = require('dns');
dns.lookup(userInput, callback);

2. Broken Authentication

Checklist:

[ ] Passwords are hashed (bcrypt, argon2, not MD5/SHA1)
[ ] JWT tokens properly validated
[ ] Sessions have timeouts
[ ] Multi-factor authentication available
[ ] Password reset tokens are single-use
[ ] Account lockout after failed attempts
[ ] Session fixation prevented
[ ] Credentials not in URLs or logs