# Security Review

> Use when performing a security review or triaging findings before launch. The repeatable method with justified N/A, the finding format, prioritization and the readiness ledger, plus the recurring rule sets: tokens in browsers, cryptographically secure random values, user-supplied paths and names, output/errors/rendering, and authorization structure. An audit whose output format changes each time cannot show whether the system is getting safer.

- Skill: `konradcinkusz/security-review` (Agent Skill, multi-file: 2 files)
- Install (CLI): `npx skillmds@latest add konradcinkusz/security-review`
- Raw SKILL.md: https://api.skillmd.com/api/skills/konradcinkusz/security-review/raw
- Safety review: pending
- Works with: Claude Code, Claude.ai, OpenAI Codex
- Category: Security
- Author: konradcinkusz (https://skillmd.com/u/konradcinkusz)
- Updated: 2026-09-17
- Page: https://skillmd.com/skills/konradcinkusz/security-review

---


# Security review: the method and the recurring rules

**Read [`references/SECURITY-REVIEW.md`](references/SECURITY-REVIEW.md) before applying any of this.**
That file is the standard; everything below it is a summary to help you decide
whether this skill applies and to check your work afterwards.

Reference-architecture principles: P5.

## What this standard covers

- The review method
- The finding format
- Prioritization and the readiness ledger
- Rule set: tokens in browsers
- Rule set: random values
- Rule set: user-supplied paths and names
- Rule set: output, errors and rendering
- Rule set: authorization structure
- Recurring launch blockers

## Checklist

- [ ] Category list worked through; every N/A justified with evidence; positive findings recorded; pentest caveat stated
- [ ] Findings in the standard format, each with an attack scenario
- [ ] Time-windowed priorities; status ledger with context column; blocks-deploy vs before-deploy split; residual risks listed
- [ ] No tokens in web storage; cookies set server-side; signature verification at every gate; header set present
- [ ] CSPRNG for anything presentable as proof; password-hash parameters recorded
- [ ] Path/name validation spec applied server-side, mirrored client-side
- [ ] Encode at render; markdown sanitized; Swagger off in production
- [ ] Deny-by-default with a short `[AllowAnonymous]` list; endpoint × role matrix produced; no identity-by-email; CORS origins explicit
- [ ] The four recurring launch blockers checked explicitly

---

Generated from [`docs/guides/SECURITY-REVIEW.md`](https://github.com/konradcinkusz/architecture-standards/blob/main/docs/guides/SECURITY-REVIEW.md) by `scripts/build-marketplace.mjs`. Do not edit this file: change the source document, or its entry in `catalog/marketplace.catalog.json`, and re-run the generator.