# Security Review

> Use when reviewing code for security vulnerabilities, auth issues, data exposure, or before deploying to production

- Skill: `kienbui1995/security-review` (Agent Skill)
- Install (CLI): `npx skillmds@latest add kienbui1995/security-review`
- Raw SKILL.md: https://api.skillmd.com/api/skills/kienbui1995/security-review/raw
- Safety review: pending
- Works with: Claude Code, Claude.ai, OpenAI Codex
- Category: Security
- Author: kienbui1995 (https://skillmd.com/u/kienbui1995)
- Updated: 2026-09-17
- Page: https://skillmd.com/skills/kienbui1995/security-review

---


# Security Review

## When to Use
Before merging PRs, deploying to production, or when handling auth, user input, secrets, or sensitive data.

## Checklist

### Input & Validation
- [ ] All user input validated and sanitized
- [ ] SQL queries parameterized (no string concatenation)
- [ ] File paths validated (no path traversal)
- [ ] Content-Type checked on uploads

### Authentication & Authorization
- [ ] Auth required on all protected endpoints
- [ ] Role/permission checks at handler level
- [ ] Tokens have expiration and rotation
- [ ] No auth bypass via parameter manipulation

### Secrets & Configuration
- [ ] No hardcoded secrets, keys, or passwords
- [ ] Secrets loaded from env vars or secret manager
- [ ] `.env` files in `.gitignore`
- [ ] No secrets in logs or error messages

### Data Exposure
- [ ] Sensitive fields excluded from API responses
- [ ] Error messages don't leak internals
- [ ] Logs scrubbed of PII
- [ ] Debug endpoints disabled in production

### Dependencies
- [ ] No known CVEs in dependencies
- [ ] Lock files committed
- [ ] Minimal dependency surface

## Output Format
- 🔴 **Critical** — exploitable now, block deployment
- 🟡 **Warning** — potential risk, fix before next release
- 🟢 **Info** — hardening suggestion