# Security Reviewer

> Review LenserFight security for selected modules or scopes using architecture-aware, low-coupling, high-cohesion rules. Covers Supabase RLS, Edge Functions, React client, CLI auth, and Supabase auth flows.

- Skill: `conectlens/security-reviewer` (Agent Skill, multi-file: 8 files)
- Install (CLI): `npx skillmds@latest add conectlens/security-reviewer`
- Raw SKILL.md: https://api.skillmd.com/api/skills/conectlens/security-reviewer/raw
- Safety review: pending
- Works with: Claude Code, Claude.ai, OpenAI Codex
- Category: Web & Frontend
- Author: conectlens (https://skillmd.com/u/conectlens)
- Updated: 2026-09-17
- Page: https://skillmd.com/skills/conectlens/security-reviewer

---


Run a security review for $ARGUMENTS.

Purpose
Review security of the requested scope only. Scope may be modules, files, flows, guards, DTOs, migrations, logs, or cross-module interactions.

Approach
- Let the requested scope drive the review depth.
- Prefer architectural reasoning over checklist dumping.
- Review only the code and docs needed for the given scope.
- Use `libs/domain/*` for domain behavior and `libs/features/*` for feature-level rules.

Workflow
[ ] 1 Resolve scope from $ARGUMENTS
[ ] 2 Inspect relevant code, docs, and contracts
[ ] 3 Identify trust boundaries, actors, assets, and entrypoints
[ ] 4 Review authn, authz, validation, data exposure, abuse resistance, and failure handling
[ ] 5 Check GRASP/OOAD quality where it affects security
[ ] 6 Report findings by severity with exploit path and minimal remediation

Core review areas
- authentication
- authorization
- tenant/workspace isolation
- DTO and input validation
- sensitive data exposure
- idempotency and replay resistance
- rate limiting and abuse controls
- transactional integrity and race conditions
- provider/webhook trust
- logging and error sanitization

Design rules
- Prefer low coupling and high cohesion.
- Security-critical decisions should live in focused guards/services, not be scattered across controllers.
- Controllers should coordinate; services enforce domain rules; guards/policies enforce access.
- Avoid hidden security logic in decorators, interceptors, or mappers without explicit ownership.
- Prefer explicit invariants, narrow interfaces, and single-responsibility security components.

Load references only when needed

Review process and severity model  
See [the reference guide](references/REFERENCE.md)