sgaabdu4 Security Review
Contract
- Scope = defensive review of user-owned/authorized code, config, artifact, URL, or design only.
- Finding = exact source/flow + preconditions + affected asset/data + realistic impact + simpler fix + verification + confidence.
- Control admission = concrete asset + plausible threat actor/path + impact/requirement + simplest sufficient maintainable control + UX/operations/dependency cost; preference/speculative hardening stays out of required scope.
- Risk response = eliminate / mitigate / transfer / accept; acceptance changes the material risk contract →
question-me; law/policy/protected harm cannot be accepted implicitly. - Focused trace = input → validation → identity/tenant policy → privileged sink/data/tool → observable impact.
- Mask secret values; report type + location + exposure path. Current advisory claim requires version-aware evidence.
- Review request = read/execute only; remediation requires explicit fix authority.
Route
| Need | Load/action |
|---|---|
| Focused auth/data/injection/upload/secret/LLM path | Apply focused trace + report contract |
| Broad application/repository review | broad.md |
| Dependency/advisory exposure | dependencies.md + research |
| Branch/PR/WIP security review | code-review owns final axes/verdict; this skill supplies security evidence |
| Existing scanners/audits/CI | deterministic-checks owns commands/results |
Result
| Status | Boundary |
|---|---|
FAIL |
Confirmed exploitable risk, exposed secret/data, broken trust boundary, or required evidence/gate failure |
CONCERNS |
Material surface unverified, plausible path lacks decisive proof, or current dependency evidence unavailable |
PASS |
Every scoped surface checked/N/A; no unresolved finding |
- Separate required findings from hardening/info; missing coverage remains explicit.
- Remediation = root owner + affected blast radius +
test-quality+deterministic-checks; never suppress evidence.