# Security

> Deep security review of code changes or a module. Use when the user asks for security review, threat check, or before auth, payments, or PII. Complements review pass 1. Not a substitute for professional pentest.

- Skill: `axidify/security` (Agent Skill)
- Install (CLI): `npx skillmds@latest add axidify/security`
- Raw SKILL.md: https://api.skillmd.com/api/skills/axidify/security/raw
- Safety review: pending
- Works with: Claude Code, Claude.ai, OpenAI Codex
- Category: Security
- Author: Axidify (https://skillmd.com/u/axidify)
- Updated: 2026-09-21
- Page: https://skillmd.com/skills/axidify/security

---


# Security review

For a full three-pass pre-commit review, start with **review**. This skill is **pass 1 only**, in depth.

Full checklist → [review/references/code-review-passes.md](../review/references/code-review-passes.md#pass-1-security)

## Checklist

1. **Scope** — changed files or module entry points; detected stack (or **discover-project**)
2. **Authn / authz** — default-deny; object-level access on every new action
3. **Input** — validation at boundaries; injection (SQL, shell, template, path, SSRF)
4. **Output** — no sensitive data in logs, errors, or client bundles
5. **Client trust** — never trust IDs, roles, ownership, prices, or permissions from the client
6. **Secrets** — env-only; scan for keys in repo, fixtures, and bundles
7. **Web** — XSS, CSRF (if applicable), unsafe uploads, insecure deserialization
8. **Ops** — rate limits on sensitive ops; secure session/cookie/token handling
9. **Dependencies** — lockfile changes; `eval`, `dangerouslySetInnerHTML`, pickle, etc.

## Per finding

| Field | Content |
|-------|---------|
| Severity | Critical / High / Medium / Low |
| File / location | Path + symbol |
| Problem | What is wrong |
| Why it matters | Exploit or exposure |
| Fix | Minimal recommended change |

**Critical / High** — must fix before merge unless user accepts risk.

## Rules

- Ground every finding in specific files/lines
- Do not claim CVEs without advisories or `npm audit` / equivalent when run
- Implement fixes only when the user asked; else propose patches → **implement**

## Related skills

- **review** — three-pass pre-commit including quick security scan
- **implement** — apply approved fixes
- **pr** — security notes in PR when relevant