# Review Security

> Review a pREST project for security issues in configs, SQL routes, auth, and AI/MCP exposure. Use when auditing prest.toml, queries, or docker setups.

- Skill: `prest/review-security` (Agent Skill)
- Install (CLI): `npx skillmds@latest add prest/review-security`
- Raw SKILL.md: https://api.skillmd.com/api/skills/prest/review-security/raw
- Safety review: pending
- Works with: Claude Code, Claude.ai, OpenAI Codex
- Category: DevOps & Infra
- Author: prest (https://skillmd.com/u/prest)
- Updated: 2026-09-17
- Page: https://skillmd.com/skills/prest/review-security

---


# Review pREST security

## When to use

- Before exposing pREST beyond localhost
- After generating a config or SQL route
- When the user asks for a security review of their pREST project

## Checklist

Inspect available `prest.toml`, `.env*`, Docker Compose, and `queries/**`:

1. **Hardcoded credentials** — passwords, JWT keys, DSNs committed in plain text
2. **Overexposed tables** — `access.restrict = false` (or unset) in non-demo contexts; missing `[[access.tables]]`
3. **Missing auth** — JWT/auth disabled or misconfigured (`jwt.default` false/unset while claiming auth; empty HMAC key behavior)
4. **Public write access** — write/delete permissions broader than needed
5. **Dangerous SQL** — unchecked deletes, dynamic SQL fragments, unbounded scans
6. **Overly privileged DB user** — superuser / owner used for the API role
7. **Exposed AI/MCP surface** — public unauthenticated `/_mcp`, `prest-mcp`, or direct Postgres access
8. **Missing environment variables** — secrets only in TOML instead of env (`PREST_MCP_TOKEN`, DB passwords, JWT keys)
9. **Debug mode** — `debug = true` in shared/staging/prod (bypasses JWT)
10. **Catalog exposure** — `/databases`, `/schemas`, `/tables` left open when they should not be (`[expose]`)
11. **SSL** — Postgres SSL mode inappropriate for the environment

## Instructions

1. Read the user's files first; ask only for missing paths.
2. Report findings by severity: Critical / High / Medium / Low.
3. For each finding: cite the file/setting, explain risk, propose a concrete fix.
4. Prefer least privilege: read-only roles, restricted tables, env-based secrets, JWT with proper verification material.
5. Flag unsafe MCP patterns: unauthenticated `/_mcp`, missing `PREST_MCP_TOKEN` on exposed endpoints, write-capable MCP database access.

## Output format

- Summary (1–3 sentences)
- Findings (severity-ordered)
- Recommended remediations (copy-paste config snippets when helpful)
- Residual risks / questions for the user