Security Review
Audit code for vulnerabilities. Report each finding with: location (file:line), severity (CRITICAL/HIGH/MEDIUM/LOW), description, and fix.
Review Order (by priority)
- Secrets -- No hardcoded keys, tokens, or passwords. All secrets in env vars.
.env* in .gitignore.
- Input validation -- All user input validated with Zod schemas. File uploads restricted (size, type, extension). No direct use of user input in queries.
- SQL injection -- All queries parameterized. No string concatenation in SQL.
- Auth/Authz -- Tokens in httpOnly cookies (not localStorage). Authorization checks before sensitive operations. RBAC enforced.
- XSS -- User HTML sanitized with DOMPurify. CSP headers configured. No unvalidated
dangerouslySetInnerHTML.
- CSRF -- CSRF tokens on state-changing operations.
SameSite=Strict on cookies.
- Rate limiting -- All API endpoints rate-limited. Stricter limits on expensive operations (search, AI generation).
- Data exposure -- No secrets in logs. Generic error messages for users. No stack traces exposed.
- Dependencies --
npm audit clean. Lock files committed.
Quick Checks
# Hardcoded secrets
grep -rn "sk-\|password\s*=\s*[\"']" --include="*.ts" --include="*.tsx" src/
# Missing input validation
grep -rn "req\.body\|req\.query\|req\.params" --include="*.ts" src/app/api/ | grep -v "parse\|validate\|schema"
# SQL concatenation
grep -rn "SELECT.*\${\|INSERT.*\${\|UPDATE.*\${\|DELETE.*\${" --include="*.ts" src/
# localStorage tokens
grep -rn "localStorage.*token\|localStorage.*key" --include="*.ts" --include="*.tsx" src/
Pre-Deployment Checklist
Error Handling
- If a finding has no clear fix (e.g., third-party library vulnerability with no patch), report it with severity and recommend mitigation (pin version, add wrapper, monitor advisory).
- If the codebase uses patterns not covered here, flag them as "NEEDS MANUAL REVIEW" with the reason.
- If no vulnerabilities are found, explicitly state "No issues found" with the scope of the review (files examined, checks performed).
References
See references/code-examples.md for detailed code patterns (secrets, validation, auth, XSS, CSRF, rate limiting, blockchain).
1---2name: security-review3description: Run a security review against code changes or files. Covers OWASP Top 10: secrets management, input validation, SQL injection, XSS, CSRF, auth/authz, rate limiting, and sensitive data exposure. Use when adding auth, handling user input, creating API endpoints, working with secrets, implementing payments, or integrating third-party APIs. Triggers: 'security review', 'check for vulnerabilities', 'audit this endpoint', 'is this safe'. Do NOT use for general code review, performance optimization, or UI/UX feedback.4---56# Security Review78Audit code for vulnerabilities. Report each finding with: location (file:line), severity (CRITICAL/HIGH/MEDIUM/LOW), description, and fix.910## Review Order (by priority)11121. **Secrets** -- No hardcoded keys, tokens, or passwords. All secrets in env vars. `.env*` in `.gitignore`.132. **Input validation** -- All user input validated with Zod schemas. File uploads restricted (size, type, extension). No direct use of user input in queries.143. **SQL injection** -- All queries parameterized. No string concatenation in SQL.154. **Auth/Authz** -- Tokens in httpOnly cookies (not localStorage). Authorization checks before sensitive operations. RBAC enforced.165. **XSS** -- User HTML sanitized with DOMPurify. CSP headers configured. No unvalidated `dangerouslySetInnerHTML`.176. **CSRF** -- CSRF tokens on state-changing operations. `SameSite=Strict` on cookies.187. **Rate limiting** -- All API endpoints rate-limited. Stricter limits on expensive operations (search, AI generation).198. **Data exposure** -- No secrets in logs. Generic error messages for users. No stack traces exposed.209. **Dependencies** -- `npm audit` clean. Lock files committed.2122## Quick Checks2324```25# Hardcoded secrets26grep -rn "sk-\|password\s*=\s*[\"']" --include="*.ts" --include="*.tsx" src/2728# Missing input validation29grep -rn "req\.body\|req\.query\|req\.params" --include="*.ts" src/app/api/ | grep -v "parse\|validate\|schema"3031# SQL concatenation32grep -rn "SELECT.*\${\|INSERT.*\${\|UPDATE.*\${\|DELETE.*\${" --include="*.ts" src/3334# localStorage tokens35grep -rn "localStorage.*token\|localStorage.*key" --include="*.ts" --include="*.tsx" src/36```3738## Pre-Deployment Checklist3940- [ ] No hardcoded secrets41- [ ] All inputs validated42- [ ] All queries parameterized43- [ ] XSS: user content sanitized, CSP configured44- [ ] CSRF protection enabled45- [ ] Auth: httpOnly cookies, RBAC enforced46- [ ] Rate limiting on all endpoints47- [ ] HTTPS enforced48- [ ] Security headers set (CSP, X-Frame-Options, X-Content-Type-Options)49- [ ] No sensitive data in logs or error responses50- [ ] Dependencies audited, lock files committed51- [ ] CORS properly configured52- [ ] File uploads validated5354## Error Handling5556- If a finding has no clear fix (e.g., third-party library vulnerability with no patch), report it with severity and recommend mitigation (pin version, add wrapper, monitor advisory).57- If the codebase uses patterns not covered here, flag them as "NEEDS MANUAL REVIEW" with the reason.58- If no vulnerabilities are found, explicitly state "No issues found" with the scope of the review (files examined, checks performed).5960## References6162See `references/code-examples.md` for detailed code patterns (secrets, validation, auth, XSS, CSRF, rate limiting, blockchain).
Cor-Incorporated