Security Review — Differential Analysis
Security-focused code review for PRs, commits, and diffs. Adapted from Trail of Bits differential-review.
Core Principles
- Risk-First: Focus on auth, crypto, payments, external calls, validation
- Evidence-Based: Every finding backed by git history, line numbers, attack scenarios
- Adaptive: Scale analysis to change size (SMALL/MEDIUM/LARGE)
- Honest: State coverage limits and confidence level
- Output-Driven: Always generate markdown report file
When to Use
- Reviewing PRs before merge to main
- Auditing commit ranges for security regressions
- Pre-deployment diff checks
- Any code change touching auth, payments, API security, or user data
When NOT to Use
- Greenfield code with no baseline (use
/security-audit instead)
- Documentation-only or formatting changes
- Quick summary explicitly requested by user
Quick Reference
Codebase Size Strategy
| Size |
Strategy |
Approach |
| SMALL (<20 files) |
DEEP |
Read all deps, full git blame |
| MEDIUM (20-200) |
FOCUSED |
1-hop deps, priority files |
| LARGE (200+) |
SURGICAL |
Critical paths only |
Risk Level Triggers
| Risk |
Triggers |
| HIGH |
Auth, crypto, payments, JWT, external calls, validation removal, DB queries |
| MEDIUM |
Business logic, state changes, new public API endpoints |
| LOW |
Comments, tests, UI styling, logging |
Red Flags (Stop and Investigate)
- Removed code from "security", "CVE", or "fix" commits
- Auth/permission checks removed
- Validation removed without replacement
- External calls added without checks
- High blast radius (50+ callers) + HIGH risk change
Workflow
Phase 0: Triage → Phase 1: Code Analysis → Phase 2: Test Coverage
↓ ↓ ↓
Phase 3: Blast Radius → Phase 4: Deep Context → Phase 5: Adversarial → Phase 6: Report
Phase 0: Triage
git diff <base>..<head> --stat
git diff <base>..<head> --name-only
Risk-score each changed file. Focus effort on HIGH risk.
Phase 1: Changed Code Analysis
For each changed file:
- Read both versions (before/after)
- Analyze each diff region: BEFORE → AFTER → CHANGE → SECURITY implications
- Git blame removed code — was it a security fix?
- Check for regressions (previously removed code re-added)
- Micro-adversarial: What attack did removed code prevent? What new surface exposed?
Phase 2: Test Coverage
# Production code changes (exclude tests)
git diff <range> --name-only | grep -v "test"
# Test changes
git diff <range> --name-only | grep "test"
Risk elevation: NEW function + NO tests → MEDIUM→HIGH
Phase 3: Blast Radius
Count callers for each modified function. Classify:
- 1-5: LOW · 6-20: MEDIUM · 21-50: HIGH · 50+: CRITICAL
Phase 4: Deep Context (HIGH risk only)
Map complete function flow:
- Entry conditions, state reads/writes, external calls, return values
- Trace internal + external calls
- Identify invariants — are they maintained after changes?
Phase 5: Adversarial Modeling (HIGH risk only)
Define attacker model:
- WHO: Unauthenticated user? Authenticated user? Compromised service?
- ACCESS: Public API? User role? Admin?
- INTERFACE: Which endpoint/function?
Build concrete exploit scenario:
ENTRY POINT: [exact endpoint]
ATTACK SEQUENCE:
1. [specific action with parameters]
2. [how it reaches vulnerable code]
3. [impact achieved]
EXPLOITABILITY: EASY/MEDIUM/HARD
CONCRETE IMPACT: [specific, measurable harm]
Phase 6: Report
Generate report at project root or a tasks directory:
# Security Review — [PR/Commit Description]
## Executive Summary
| Severity | Count |
|----------|-------|
| CRITICAL | X |
| HIGH | Y |
| MEDIUM | Z |
| LOW | W |
**Overall Risk:** CRITICAL/HIGH/MEDIUM/LOW
**Recommendation:** APPROVE/REJECT/CONDITIONAL
## What Changed
| File | +Lines | -Lines | Risk | Blast Radius |
|------|--------|--------|------|--------------|
## Findings
### [SEVERITY] Title
**File**: path:line
**Commit**: hash
**Blast Radius**: N callers
**Test Coverage**: YES/NO
**Description**: ...
**Attack Scenario**: ...
**Recommendation**: ...
## Test Coverage Analysis
## Recommendations
### Immediate (Blocking)
### Before Production
### Technical Debt
## Methodology
- Strategy: DEEP/FOCUSED/SURGICAL
- Files reviewed: X/Y
- Confidence: HIGH/MEDIUM/LOW
Project-Specific High-Risk Areas
Before starting a review, identify and examine with extra scrutiny the project-specific high-risk areas, typically including:
- Auth endpoints — login, registration, token creation/refresh
- Payment handling — payment gateway integration, webhook handlers
- Middleware/config — CORS, error handlers, security middleware
- Database layer — connection management, credential handling, raw SQL queries
- External API integrations — API key management, prompt injection surface
- Client-side auth — API URL handling, auth token transmission, session management
Quality Checklist
Before delivering:
1---2name: security-review3description: Security-focused differential code review for PRs, commits, and diffs. Calculates blast radius, checks test coverage, models attacks, and generates markdown reports. Based on Trail of Bits methodology. Use for PR reviews, commit audits, and pre-deployment diff checks. For full codebase audits, use /security-audit instead.4---56# Security Review — Differential Analysis78Security-focused code review for PRs, commits, and diffs. Adapted from [Trail of Bits differential-review](https://github.com/trailofbits/skills).910## Core Principles11121. **Risk-First**: Focus on auth, crypto, payments, external calls, validation132. **Evidence-Based**: Every finding backed by git history, line numbers, attack scenarios143. **Adaptive**: Scale analysis to change size (SMALL/MEDIUM/LARGE)154. **Honest**: State coverage limits and confidence level165. **Output-Driven**: Always generate markdown report file1718## When to Use1920- Reviewing PRs before merge to main21- Auditing commit ranges for security regressions22- Pre-deployment diff checks23- Any code change touching auth, payments, API security, or user data2425## When NOT to Use2627- Greenfield code with no baseline (use `/security-audit` instead)28- Documentation-only or formatting changes29- Quick summary explicitly requested by user3031---3233## Quick Reference3435### Codebase Size Strategy3637| Size | Strategy | Approach |38|------|----------|----------|39| SMALL (<20 files) | DEEP | Read all deps, full git blame |40| MEDIUM (20-200) | FOCUSED | 1-hop deps, priority files |41| LARGE (200+) | SURGICAL | Critical paths only |4243### Risk Level Triggers4445| Risk | Triggers |46|------|----------|47| HIGH | Auth, crypto, payments, JWT, external calls, validation removal, DB queries |48| MEDIUM | Business logic, state changes, new public API endpoints |49| LOW | Comments, tests, UI styling, logging |5051### Red Flags (Stop and Investigate)5253- Removed code from "security", "CVE", or "fix" commits54- Auth/permission checks removed55- Validation removed without replacement56- External calls added without checks57- High blast radius (50+ callers) + HIGH risk change5859---6061## Workflow6263```64Phase 0: Triage → Phase 1: Code Analysis → Phase 2: Test Coverage65 ↓ ↓ ↓66Phase 3: Blast Radius → Phase 4: Deep Context → Phase 5: Adversarial → Phase 6: Report67```6869### Phase 0: Triage7071```bash72git diff <base>..<head> --stat73git diff <base>..<head> --name-only74```7576Risk-score each changed file. Focus effort on HIGH risk.7778### Phase 1: Changed Code Analysis7980For each changed file:811. Read both versions (before/after)822. Analyze each diff region: BEFORE → AFTER → CHANGE → SECURITY implications833. Git blame removed code — was it a security fix?844. Check for regressions (previously removed code re-added)855. Micro-adversarial: What attack did removed code prevent? What new surface exposed?8687### Phase 2: Test Coverage8889```bash90# Production code changes (exclude tests)91git diff <range> --name-only | grep -v "test"92# Test changes93git diff <range> --name-only | grep "test"94```9596Risk elevation: NEW function + NO tests → MEDIUM→HIGH9798### Phase 3: Blast Radius99100Count callers for each modified function. Classify:101- 1-5: LOW · 6-20: MEDIUM · 21-50: HIGH · 50+: CRITICAL102103### Phase 4: Deep Context (HIGH risk only)104105Map complete function flow:106- Entry conditions, state reads/writes, external calls, return values107- Trace internal + external calls108- Identify invariants — are they maintained after changes?109110### Phase 5: Adversarial Modeling (HIGH risk only)111112Define attacker model:113- **WHO**: Unauthenticated user? Authenticated user? Compromised service?114- **ACCESS**: Public API? User role? Admin?115- **INTERFACE**: Which endpoint/function?116117Build concrete exploit scenario:118```119ENTRY POINT: [exact endpoint]120ATTACK SEQUENCE:1211. [specific action with parameters]1222. [how it reaches vulnerable code]1233. [impact achieved]124EXPLOITABILITY: EASY/MEDIUM/HARD125CONCRETE IMPACT: [specific, measurable harm]126```127128### Phase 6: Report129130Generate report at project root or a tasks directory:131132```markdown133# Security Review — [PR/Commit Description]134135## Executive Summary136| Severity | Count |137|----------|-------|138| CRITICAL | X |139| HIGH | Y |140| MEDIUM | Z |141| LOW | W |142143**Overall Risk:** CRITICAL/HIGH/MEDIUM/LOW144**Recommendation:** APPROVE/REJECT/CONDITIONAL145146## What Changed147| File | +Lines | -Lines | Risk | Blast Radius |148|------|--------|--------|------|--------------|149150## Findings151### [SEVERITY] Title152**File**: path:line153**Commit**: hash154**Blast Radius**: N callers155**Test Coverage**: YES/NO156**Description**: ...157**Attack Scenario**: ...158**Recommendation**: ...159160## Test Coverage Analysis161## Recommendations162### Immediate (Blocking)163### Before Production164### Technical Debt165166## Methodology167- Strategy: DEEP/FOCUSED/SURGICAL168- Files reviewed: X/Y169- Confidence: HIGH/MEDIUM/LOW170```171172---173174## Project-Specific High-Risk Areas175176Before starting a review, identify and examine with extra scrutiny the project-specific high-risk areas, typically including:177178- **Auth endpoints** — login, registration, token creation/refresh179- **Payment handling** — payment gateway integration, webhook handlers180- **Middleware/config** — CORS, error handlers, security middleware181- **Database layer** — connection management, credential handling, raw SQL queries182- **External API integrations** — API key management, prompt injection surface183- **Client-side auth** — API URL handling, auth token transmission, session management184185---186187## Quality Checklist188189Before delivering:190- [ ] All changed files analyzed191- [ ] Git blame on removed security code192- [ ] Blast radius calculated for HIGH risk193- [ ] Attack scenarios are concrete (not generic)194- [ ] Findings reference specific line numbers + commits195- [ ] Report file generated196- [ ] User notified with summary
kennyolofsson23-netizen