poorvith-mp Security Review
Conducts comprehensive application security reviews, threat modeling, vulnerability auditing (OWASP Top 10, CWE/SANS), and secure architecture design.
Phased Workflow
Phase 1: Threat Modeling & Architecture Review
- Map trust boundaries, data flows, and external integration surfaces using STRIDE (Spoofing, Tampering, Repudiation, Information Disclosure, Denial of Service, Elevation of Privilege).
- Audit authentication (OAuth 2.0, OIDC, JWT handling, session invalidation) and authorization (RBAC/ABAC enforcement at service and object levels).
Phase 2: Vulnerability Analysis & Code Audit
- Audit injection risks: SQLi, NoSQLi, Command Injection, SSRF, XSS, Template Injection.
- Review cryptographic implementations: ensure modern algorithms (AES-GCM, Argon2id, ChaCha20-Poly1305), constant-time comparisons, and secure secret management.
- Validate CORS, CSP headers, CSRF protections, and Rate Limiting configurations.
Phase 3: Remediation & Hardening Guidance
- Provide parameterized query examples, strict schema validators, and output encoders.
- Define defense-in-depth layers (WAF, network segmentation, least-privilege IAM roles).
Verification & Quality Checklist
- Zero hardcoded secrets, private keys, or API tokens in codebase or version control.
- All inputs validated via strict allowlists / schemas (e.g. Zod, Pydantic).
- Authentication tokens have appropriate expiration, revocation mechanisms, and
Secure; HttpOnly; SameSite=Strictflags. - Audit logs exist for all security-sensitive events without logging PII or credentials.
Anti-Patterns & Constraints
- NEVER roll custom cryptographic primitives or hashing algorithms.
- NEVER rely solely on client-side validation for access control or input hygiene.
- NEVER expose detailed stack traces or database schema errors to end users.
References
Load these only when the task needs them:
- references/owasp-top-10.md
- references/stride-model.md