# Secure Code Review

> Repeatable process for an application security code review that produces prioritized findings and fix guidance. Use when this capability is needed.

- Skill: `tomevault-io/secure-code-review-4` (Agent Skill, multi-file: 2 files)
- Install (CLI): `npx skillmds@latest add tomevault-io/secure-code-review-4`
- Raw SKILL.md: https://api.skillmd.com/api/skills/tomevault-io/secure-code-review-4/raw
- Safety review: pending
- Works with: Claude Code, Claude.ai, OpenAI Codex
- Category: Security
- Author: tomevault-io (https://skillmd.com/u/tomevault-io)
- Updated: 2026-09-17
- Page: https://skillmd.com/skills/tomevault-io/secure-code-review-4

---


# Secure Code Review

## When to use

Use this skill when asked to **review code for security**, produce findings, or prepare guidance for remediation.

## Inputs to collect (if available)

- What component(s) are in scope (API, UI, worker, infra scripts)
- Data sensitivity (PII, auth/session, payments)
- Deployment assumptions (internet-facing, internal, multi-tenant)
- Any known incidents, CVEs, or audit requirements

## Step-by-step process

1. **Map entry points & trust boundaries**
   - Enumerate request handlers, background consumers, file parsers, template renderers, and admin endpoints.
   - Identify where untrusted input crosses into privileged actions or sensitive sinks.
2. **Scan for high-risk classes**
   - Injection: SQL/NoSQL/LDAP/OS/template
   - Authn/authz: missing checks, insecure defaults, confused deputy
   - Deserialization & file handling: unsafe loads, path traversal, upload
   - Crypto: homegrown crypto, weak randomness, token validation mistakes
   - Logging: secrets/PII exposure, overly verbose errors
   - SSRF: URL fetchers, webhook validation gaps
3. **Deep-dive the highest impact areas**
   - Trace data flow from input → validation → authorization → sink.
   - Look for missing allow-lists, type confusion, and implicit conversions.
4. **Write findings in a consistent format**
   - Title, severity, confidence
   - Where (file/function)
   - Risk + prerequisites
   - Repro steps
   - Recommendation + verification steps
5. **Close with a remediation plan**
   - Quick wins (hours), medium fixes (days), structural guardrails (weeks).

## Output template

### Summary

- Scope reviewed:
- Top issues:
- Overall risk: Low / Medium / High / Critical

### Findings (repeat)

- **Title**
- **Severity / Confidence**
- **Where**
- **Risk**
- **Repro**
- **Recommendation**
- **Verification**

## Repo integration (optional)

If this repo includes prompt files under `/prompts`, the following are commonly relevant:

- `secure-code-review.prompt.md`
- `scan-for-insecure-apis.prompt.md`
- `validate-input-handling.prompt.md`
- `review-auth-flows.prompt.md`

---
> Converted and distributed by [TomeVault](https://tomevault.io/claim/robotti-io) — claim your Tome and manage your conversions.
<!-- tomevault:4.0:skill_md:2026-04-11 -->