# Security Review

> Perform a comprehensive security review of the current code and provide specific remediation...; keywords: security, api, review, error. Use only on explicit request; before execution, review diffs and list impact scope.

- Skill: `gologo13/security-review` (Agent Skill)
- Install (CLI): `npx skillmds@latest add gologo13/security-review`
- Raw SKILL.md: https://api.skillmd.com/api/skills/gologo13/security-review/raw
- Safety review: pending
- Works with: Claude Code, Claude.ai, OpenAI Codex
- Category: Security
- Author: gologo13 (https://skillmd.com/u/gologo13)
- Updated: 2026-09-17
- Page: https://skillmd.com/skills/gologo13/security-review

---


# Security Review

## Overview

Perform a comprehensive security review of the current code and provide specific remediation steps with code examples for each security issue identified.

## Steps

1. **Authentication & Authorization**
    - Verify proper authentication mechanisms
    - Check authorization controls and permission systems
    - Review session management and token handling
    - Ensure secure password policies and storage
2. **Input Validation & Sanitization**
    - Identify SQL injection vulnerabilities
    - Check for XSS and CSRF attack vectors
    - Validate all user inputs and API parameters
    - Review file upload and processing security
3. **Data Protection**
    - Ensure sensitive data encryption at rest and in transit
    - Check for data exposure in logs and error messages
    - Review API responses for information leakage
    - Verify proper secrets management
4. **Infrastructure Security**
    - Review dependency security and known vulnerabilities
    - Check HTTPS configuration and certificate validation
    - Analyze CORS policies and security headers
    - Review environment variable and configuration security

## Security Review Checklist

- [ ] Verified proper authentication mechanisms
- [ ] Checked authorization controls and permission systems
- [ ] Reviewed session management and token handling
- [ ] Ensured secure password policies and storage
- [ ] Identified SQL injection vulnerabilities
- [ ] Checked for XSS and CSRF attack vectors
- [ ] Validated all user inputs and API parameters
- [ ] Ensured sensitive data encryption at rest and in transit
- [ ] Checked for data exposure in logs and error messages
- [ ] Reviewed dependency security and known vulnerabilities
- [ ] Analyzed CORS policies and security headers