security-review

Security Review

On Claude Code, prefer the native /security-review. It is a command, not a skill, so it always fires — including headless — and it has grown capabilities this one does not have: Reach for it first.

This surface remains because caddis ships to harnesses that have no native equivalent — agy, Codex and Copilot. There it is the only review you get. Do not delete it to tidy up Claude Code.

/caddis:cross-review is NOT replaced by either. It sends the diff to a different vendor's model, which neither this nor the native reviewer can do.

Security review workflow covering OWASP Top 10, code scanning, and cloud infrastructure.

When to Use

• Implementing authentication or authorization
• Handling user input or file uploads
• Creating or modifying API endpoints
• Working with secrets, deploying to cloud, or configuring CI/CD

Phase 1: OWASP Top 10 Checks

A01 — Broken Access Control

# BAD — no auth check
@app.route("/admin/users")
def list_users():
    return db.query(User).all()

# GOOD
@app.route("/admin/users")
@require_role("admin")
def list_users():
    return db.query(User).all()

• Every endpoint checks authentication
• Role-based access control enforced
• Users cannot access other users' data (IDOR)

A02 — Cryptographic Failures

# BAD: password_hash = hashlib.md5(password.encode()).hexdigest()
# GOOD:
from passlib.hash import argon2
password_hash = argon2.hash(password)

• Passwords hashed with bcrypt/argon2
• Sensitive data encrypted at rest and in transit
• No secrets in source code or logs

A03 — Injection

# BAD: cursor.execute(f"SELECT * FROM users WHERE email = '{email}'")
# GOOD:
cursor.execute("SELECT * FROM users WHERE email = %s", (email,))

• All queries parameterized or use ORM
• No eval(), exec(), or os.system() with user input

A05 — Security Misconfiguration

• Debug mode disabled in production
• Default credentials changed
• Unnecessary endpoints disabled