arogyareddy Security
Use this for feature reviews, auth flows, API endpoints, config audits, and pre-release hardening.
Checklist
- Authentication and authorization correctness.
- Input validation and output encoding.
- Injection risk: SQL, command, template, HTML, path traversal.
- Secret handling, token leakage, verbose logs.
- Session, cookie, CSRF, CORS, and redirect handling.
- Unsafe file upload/download behavior.
- Dependency and config risk.
Workflow
- Map trust boundaries.
- Identify external inputs and privileged actions.
- Check authorization at the actual execution point.
- Check data exposure in logs, errors, traces, and client responses.
- Identify exploit path, impact, and fix.
Output format
- Findings by severity
- Exploit scenario
- Fix recommendation
- Validation steps