# Review Standards > Use this skill when asked to review authentication code for security issues. - Skill: `tomevault-io/review-standards` (Agent Skill, multi-file: 2 files) - Install (CLI): `npx skillmds@latest add tomevault-io/review-standards` - Raw SKILL.md: https://api.skillmd.com/api/skills/tomevault-io/review-standards/raw - Safety review: pending (external: skill-scanner PASS, skillspector PASS) - Works with: Claude Code, Claude.ai, OpenAI Codex - Category: Security - Author: tomevault-io (https://skillmd.com/u/tomevault-io) - Updated: 2026-09-17 - Page: https://skillmd.com/skills/tomevault-io/review-standards --- When reviewing authentication code: 1. Check password hashing. 2. Check whether secrets or tokens are compared with `===`. 3. Use the issue id `weak-password-hash` when passwords use SHA-1 or MD5. 4. Use the issue id `timing-unsafe-compare` when secrets or tokens use a direct equality comparison. 5. Report only issues that match the user's requested scope. --- > Source: [promptfoo/promptfoo](https://github.com/promptfoo/promptfoo) — distributed by [TomeVault](https://tomevault.io).