bottelet Security Review
Purpose
Detect security risks in code during review phase. This skill does NOT enforce security. It identifies issues.
Scope
This skill evaluates:
- authorization checks (missing or bypassed)
- policy usage correctness
- privilege escalation risks
- unsafe controller or action exposure
- validation gaps on external input
Ownership Boundary
Security Review does NOT:
- implement policies
- define roles/permissions
- execute middleware logic
- enforce runtime access control
Those belong to application security layers (Policies, Middleware, Gates).
Rules
- Every sensitive action MUST have explicit authorization check
- No unguarded resource actions (create/update/delete/view)
- No direct access to privileged operations without policy validation
- Input from external sources MUST be validated before use
Escalation Principle
If a potential security issue is detected:
- assume it is a defect until proven otherwise
- prioritize security over architectural convenience