hebertzhu security-best-practices
Intent
- Perform language and framework specific security best-practice reviews and suggest improvements. Trigger only when the user explicitly requests security best practices guidance, a security review/report, or secure-by-default coding help. Trigger only for supported languages (python, javascript/typescript, go). Do not trigger for general code review, debugging, or non-security tasks.
Default operating pattern
- Identify assets, trust boundaries, attacker assumptions, and sensitive flows.
- Inspect the current implementation or design surface that creates risk.
- Rank issues by impact, likelihood, and exploitability.
- Recommend the smallest safe-by-default changes that materially reduce exposure.
- Note verification steps and any residual risk that still remains.
Pack fit
- Included in:
release-quality,security-quality - Keep examples generic, privacy-safe, and portable across hosts.
Boundary
- Do not relabel a generic code review as a security review without actual security scope.