# Secure Code Review

> Perform a security-focused code review — map trust boundaries, audit input paths and auth flows, and use vulnerability-class-driven checklists instead of line-by-line skimming. Use on any PR or codebase with security implications.

- Skill: `securityskills/secure-code-review` (Agent Skill)
- Install (CLI): `npx skillmds@latest add securityskills/secure-code-review`
- Raw SKILL.md: https://api.skillmd.com/api/skills/securityskills/secure-code-review/raw
- Safety review: pending
- Works with: Claude Code, Claude.ai, OpenAI Codex
- Category: Security
- Author: securityskills (https://skillmd.com/u/securityskills)
- Updated: 2026-09-17
- Page: https://skillmd.com/skills/securityskills/secure-code-review

---


# Secure Code Review

Review code for vulnerabilities systematically, not line-by-line.

## 1. Orient

- What does this code do? Identify: entry points, trust boundaries, data stores, privileged operations
- Read the tests — what invariants do they reveal?
- Check the diff's blast radius: auth logic? parsing? file handling? crypto?

## 2. Trace Untrusted Data

Follow each input from entry point to sink:

| Sink Class | What to Verify |
|---|---|
| SQL/NoSQL | Parameterized; no string-built queries; identifiers whitelisted |
| Command exec | No user data in shell strings; argv-array APIs; no shell=True |
| HTML/rendering | Contextual auto-escaping; raw/unsafe HTML flags justified |
| File paths | Basename/allowlist; canonicalize + prefix check; no user paths in includes |
| Deserialization | Typed formats (JSON) over object serializers; validation post-parse |
| Redirects | Relative-only or allowlisted targets |
| Eval/dynamic code | Justified and input-free, or rejected |

## 3. Audit Auth and Access Control

- Every endpoint enforces authz server-side; role checks at the resource, not the controller only
- Object-level checks (IDOR): does the query filter by the caller's tenant/user ID?
- Session management: rotation, invalidation, secure cookie flags
- Password reset flows: token entropy, expiry, single-use, no account enumeration

## 4. Audit Secrets and Config

- No hardcoded credentials/keys/API tokens; no secrets in logs or error messages
- Crypto: approved algorithms, library primitives (not hand-rolled), correct modes, random from CSPRNG

## 5. Race and State

- TOCTOU on file checks, check-then-use on quotas/credits
- Concurrency on mutable shared state; missing transactions on multi-step writes

## Communication

Report findings with severity, the specific code path, an exploit sketch, and a suggested fix. Distinguish "must fix" from "harden later."