Security Review

Security Review

Systematic security checklist for code changes. Catch vulnerabilities before they ship.

When to Use

• After writing authentication or authorization code
• After handling user input (forms, query params, file uploads)
• After creating or modifying API endpoints
• After touching secrets, tokens, or credentials
• Before any commit that touches security-sensitive code

Procedure

Step 1: Identify Scope

Determine which checks apply based on changed files:

• Auth code: full checklist
• API endpoints: input validation, injection, rate limiting
• Frontend: XSS, CSRF
• Config/infra: secrets, permissions

Step 2: Run Checklist

| Check | Severity | What to Look For | |-------|----------|------------------| | Hardcoded secrets | CRITICAL | API keys, passwords, tokens in source | | SQL injection | CRITICAL | String concatenation in queries | | Auth bypass | CRITICAL | Missing auth checks on protected routes | | XSS | HIGH | Unsanitized user input in HTML output | | CSRF | HIGH | Missing CSRF tokens on state-changing requests | | Input validation | HIGH | Unvalidated user input passed to logic | | Rate limiting | MEDIUM | Endpoints without rate limits | | Error leaks | MEDIUM | Stack traces or internal details in responses | | Authz checks | HIGH | Missing permission verification | | Dependency vulns | MEDIUM | Known CVEs in dependencies |

Step 3: Scan Code

# Check for hardcoded secrets (patterns)
grep -rn "password\s*=\s*['\"]" --include="*.{ts,js,py,go}" .
grep -rn "api_key\s*=\s*['\"]" --include="*.{ts,js,py,go}" .
grep -rn "secret\s*=\s*['\"]" --include="*.{ts,js,py,go}" .

# Check for SQL string concatenation
grep -rn "SELECT.*+.*FROM\|INSERT.*+.*INTO" --include="*.{ts,js,py,go}" .

# Check dependency audit
npm audit 2>/dev/null || pip-audit 2>/dev/null || true

Step 4: Report

Security Review: {scope description}

CRITICAL:
- {finding with file:line and fix}

HIGH:
- {finding with file:line and fix}

MEDIUM:
- {finding or "none"}

LOW:
- {finding or "none"}

Verdict: PASS | BLOCKED ({count} CRITICAL issues)

Blocking Rules

• CRITICAL: Must fix before commit. No exceptions.
• HIGH: Must fix before PR merge. Document if deferring.
• MEDIUM: Fix when possible. Track in backlog if deferring.
• LOW: Informational. Fix at convenience.

Output Format

Security Review: User authentication endpoints

CRITICAL: none
HIGH:
- src/api/login.ts:42 - Missing rate limiting on login endpoint
  Fix: Add express-rate-limit middleware (max 5 attempts/min)
MEDIUM:
- src/api/profile.ts:18 - Error response includes stack trace
  Fix: Use generic error message in production
LOW: none

Verdict: PASS (0 CRITICAL, 1 HIGH to fix before merge)

Rules

• Run on every commit that touches auth, input, or API code
• CRITICAL findings stop all work until fixed
• If secrets are found in code, rotate them immediately
• Never suppress findings; document accepted risks explicitly
• Check both new code AND existing code in modified files

Source & license

This open-source skill is cataloged on AgentStack and links to its original source — we do not rehost the code.

• Author: mshadmanrahman
• Source: mshadmanrahman/pm-pilot
• License: MIT
• Homepage: https://github.com/mshadmanrahman/pm-pilot#readme

Install and usage instructions live in the source repository linked above.