Security Review Audit

Security Code Review Guide

Overview

Perform thorough security reviews of code to identify vulnerabilities, misconfigurations, and security anti-patterns. This skill helps you think like an attacker while providing actionable fixes.

Process

Phase 1: Reconnaissance

Before diving into code, understand the attack surface:

1.1 Identify Entry Points

• HTTP endpoints (routes, controllers, handlers)
• API endpoints (REST, GraphQL, gRPC)
• WebSocket handlers
• File upload handlers
• Authentication endpoints
• Admin/privileged endpoints

1.2 Identify Data Flows

• User input sources (forms, query params, headers, cookies)
• Database queries and ORM usage
• External API calls
• File system operations
• Command execution
• Serialization/deserialization

1.3 Identify Trust Boundaries

• Authentication checks
• Authorization/permission checks
• Input validation layers
• Output encoding layers

Phase 2: Vulnerability Hunting

Systematically check for each vulnerability class:

2.1 Injection Vulnerabilities

SQL Injection

• Look for string concatenation in queries
• Check ORM usage for raw queries
• Verify parameterized queries are used
• Check stored procedures for dynamic SQL

Command Injection

• Find all exec, system, popen, subprocess calls
• Check for user input in command arguments
• Verify proper escaping or allowlisting

XSS (Cross-Site Scripting)

• Find all places user input is rendered in HTML
• Check for proper output encoding
• Look for innerHTML, dangerouslySetInnerHTML, v-html
• Check CSP headers

Template Injection

• Find template rendering with user input
• Check for SSTI in Jinja2, Twig, ERB, etc.

2.2 Authentication & Session

Authentication Flaws

• Password hashing (bcrypt/argon2 vs MD5/SHA1)
• Timing-safe comparison for secrets
• Account enumeration via error messages
• Brute force protection
• Password reset flow security

Session Management

• Session token entropy
• Secure cookie flags (HttpOnly, Secure, SameSite)
• Session fixation protection
• Session timeout/invalidation

2.3 Authorization

Broken Access Control

• IDOR (Insecure Direct Object References)
• Missing function-level access control
• Privilege escalation paths
• JWT validation issues

2.4 Cryptography

Crypto Weaknesses

• Hardcoded secrets/keys
• Weak algorithms (MD5, SHA1, DES, RC4)
• ECB mode usage
• Missing or weak random number generation
• Certificate validation disabled

2.5 Data Exposure

Sensitive Data

• Secrets in logs
• PII in error messages
• Sensitive data in URLs
• Missing encryption at rest
• Verbose error messages in production

Phase 3: Reporting

For each finding, document:

1. Vulnerability Type: CWE ID and name
2. Severity: Critical/High/Medium/Low
3. Location: File, line number, function
4. Description: What the vulnerability is
5. Impact: What an attacker could do
6. Proof of Concept: How to exploit (if safe)
7. Remediation: Specific fix with code example

Phase 4: Fix Verification

After fixes are applied:

• Verify the fix addresses the root cause
• Check for regression in related code
• Ensure fix doesn't introduce new issues
• Add tests to prevent regression

Reference Files

Load these as needed during review:

• OWASP Top 10 - Most critical web vulnerabilities
• Language Patterns - Language-specific vulnerability patterns
• Secure Coding Checklist - Quick reference checklist
• Common Fixes - Code examples for common fixes

Quick Reference: OWASP Top 10 (2021)