kimtth Goal: find and fix security flaws before they ship.
Use for:
- reviewing a feature, endpoint, or design for risk
- auditing input handling, auth, and data exposure
- hardening code against common attacks
Workflow:
- Map the trust boundaries and where untrusted data enters.
- Check input validation and output encoding at each boundary.
- Verify authentication and authorization on every path.
- Look for injection: SQL, command, template, and XSS.
- Check secrets handling, crypto use, and data exposure.
- Confirm dependencies are current and known-good.
OWASP focus:
- broken access control and IDOR
- injection and unsafe deserialization
- security misconfiguration and verbose errors
- sensitive data exposure and weak crypto
Rules:
- never trust client input; validate and encode
- enforce authorization server-side at the data layer
- use parameterized queries and safe APIs, always
- keep secrets out of code, logs, and error messages