code-sec-review

Purpose

A correctness review does not model an attacker. This skill runs the security pass: a researcher-style hunt for exploitable weaknesses, prioritized by what an attacker can actually reach. The review is static — it reads code and runs static tools, never exploits.

Procedure

1. Initialize the progress file. Create .memory/reviews/review-security-<timestamp>.md:

   # Security Review Progress
   
   ## Status
   - Last updated: <timestamp>
   - Overall: In Progress
   
   ## Phases
   - [ ] 1. Attack surface, trust boundaries, and ranked targets
   - [ ] 2. Available instruments
   - [ ] 3. Regressions and removed controls
   - [ ] 4. Public path reachability
   - [ ] 5. Tenant isolation
   - [ ] 6. Untrusted data flows
   - [ ] 7. Authentication and sessions
   - [ ] 8. Authorization and business logic
   - [ ] 9. Secrets, cryptography, and data protection
   - [ ] 10. Supply chain and configuration
   - [ ] 11. Malicious code and reviewer-targeted injection
   - [ ] 12. Revalidation, chains, and fix verification
   - [ ] 13. Finding classification and coverage
   
   ## Findings
   

2. Attack surface, trust boundaries, and ranked targets. Read the changed files. Then read the routing, middleware, and data-access files that give them meaning. Answer:

   • Which entry points does the change add or modify? An entry point accepts input from outside the component: HTTP route, GraphQL resolver, gRPC method, webhook, queue consumer, CLI command, cron job, WebSocket handler, file watcher, or agent tool.
   • Who can reach each entry point? Classify as anonymous, authenticated, privileged, internal service, or machine-to-machine. Read the guard and confirm two things: that the guard runs, and that its predicate checks the right thing. A directly wrapped guard is attached — check that it tests the authenticated identity, not a client-supplied header, and the correct role or owner. A route-group guard passes when it covers every route in the group, has no exclusion pattern, and no sibling route escapes it. An edge, proxy, or platform rule never passes on its own.
   • What crosses each trust boundary? Name the data entering and leaving.
   • What existing code does this change make newly reachable? A new route, import, helper, or permission can expose a sink that already existed.
   • Is the system multi-tenant? Find how the tenant is identified and where the boundary sits.
   • What are the crown jewels? Name the assets that matter: credentials and tokens, PII, payment data, health data, private files, and admin actions. Record the blast radius if each leaks or changes.