# Secure Code Review

> Use this skill when reviewing or writing code that handles user input, authentication, file I/O, network requests, or database queries. Always check for common security vulnerabilities before considering the code complete.

- Skill: `gabrielmoreira/secure-code-review` (Agent Skill)
- Install (CLI): `npx skillmds@latest add gabrielmoreira/secure-code-review`
- Raw SKILL.md: https://api.skillmd.com/api/skills/gabrielmoreira/secure-code-review/raw
- Safety review: pending (external: skill-scanner PASS, skillspector PASS)
- Works with: Claude Code, Claude.ai, OpenAI Codex
- Category: Security
- Author: gabrielmoreira (https://skillmd.com/u/gabrielmoreira)
- Updated: 2026-09-21
- Page: https://skillmd.com/skills/gabrielmoreira/secure-code-review

---


# Secure Code Review Checklist

**Input Validation:**
- Never trust user-supplied input; validate type, length, and format at boundaries.
- Use parameterized queries — never string-interpolate SQL.
- Sanitize before rendering HTML to prevent XSS.

**Secrets & Credentials:**
- No hardcoded passwords, API keys, or tokens in source code.
- Use environment variables or a secrets manager.
- Check `.gitignore` before adding any config files.

**Dependencies:**
- Pin dependency versions; audit with `pip audit` or `npm audit`.
- Minimize surface area: remove unused packages.

**Auth:**
- Verify authorization on every protected endpoint, not just at login.
- Use short-lived tokens; implement refresh flows.