Axidify Security review
For a full three-pass pre-commit review, start with review. This skill is pass 1 only, in depth.
Full checklist → review/references/code-review-passes.md
Checklist
- Scope — changed files or module entry points; detected stack (or discover-project)
- Authn / authz — default-deny; object-level access on every new action
- Input — validation at boundaries; injection (SQL, shell, template, path, SSRF)
- Output — no sensitive data in logs, errors, or client bundles
- Client trust — never trust IDs, roles, ownership, prices, or permissions from the client
- Secrets — env-only; scan for keys in repo, fixtures, and bundles
- Web — XSS, CSRF (if applicable), unsafe uploads, insecure deserialization
- Ops — rate limits on sensitive ops; secure session/cookie/token handling
- Dependencies — lockfile changes;
eval,dangerouslySetInnerHTML, pickle, etc.
Per finding
| Field | Content |
|---|---|
| Severity | Critical / High / Medium / Low |
| File / location | Path + symbol |
| Problem | What is wrong |
| Why it matters | Exploit or exposure |
| Fix | Minimal recommended change |
Critical / High — must fix before merge unless user accepts risk.
Rules
- Ground every finding in specific files/lines
- Do not claim CVEs without advisories or
npm audit/ equivalent when run - Implement fixes only when the user asked; else propose patches → implement
Related skills
- review — three-pass pre-commit including quick security scan
- implement — apply approved fixes
- pr — security notes in PR when relevant