# Secure Review

> Apply the team's secure-review checklist when reviewing code that handles user input, authentication, or database access.

- Skill: `huangjia2019/secure-review` (Agent Skill)
- Install (CLI): `npx skillmds@latest add huangjia2019/secure-review`
- Raw SKILL.md: https://api.skillmd.com/api/skills/huangjia2019/secure-review/raw
- Safety review: pending
- Works with: Claude Code, Claude.ai, OpenAI Codex
- Category: Coding & Dev Tools
- Author: huangjia2019 (https://skillmd.com/u/huangjia2019)
- Updated: 2026-09-17
- Page: https://skillmd.com/skills/huangjia2019/secure-review

---

# Secure review checklist

Walk the change against this list, in order. Stop and report as soon as you find
a Critical item — it blocks the merge.

## Critical
- Any SQL built by string concatenation with user input
- Secrets committed in source, config, or test fixtures
- A state-changing endpoint with no authorization check

## High
- User input reaching a shell command
- Unbounded queries (no LIMIT) on user-facing endpoints

## Medium
- Missing input length validation
- Errors returning stack traces to the client

Report findings as: severity, file:line, exploit path, fix.