# Security Review

> Evaluate code for security vulnerabilities and privacy compliance. Use when reviewing code that handles file input, storage, external APIs, or sensitive data. Use when this capability is needed.

- Skill: `tomevault-io/security-review-13` (Agent Skill, multi-file: 2 files)
- Install (CLI): `npx skillmds@latest add tomevault-io/security-review-13`
- Raw SKILL.md: https://api.skillmd.com/api/skills/tomevault-io/security-review-13/raw
- Safety review: pending (external: skill-scanner PASS, skillspector PASS)
- Works with: Claude Code, Claude.ai, OpenAI Codex
- Category: Security
- Author: tomevault-io (https://skillmd.com/u/tomevault-io)
- Updated: 2026-09-17
- Page: https://skillmd.com/skills/tomevault-io/security-review-13

---


# Security Review

## Review Areas

### File Input Parsing (Critical)

EDF files from SD cards are **untrusted binary input**. Review for:

- Buffer overflow via malformed headers (check bounds before reading)
- Integer overflow in size/length fields
- Infinite loops from circular references or self-referencing structures
- Memory exhaustion from exaggerated size fields
- Path traversal if filenames are extracted from file content

### Content Rendering

- XSS via imported data rendered in the DOM (sanitize all dynamic content)
- Prototype pollution via JSON parsing of imported settings/sessions
- Template injection in user-facing strings

### Storage Security

- IndexedDB/OPFS data isolation (verify origin enforcement)
- Secure deletion (overwrite sensitive data before removing, where possible)
- Quota exceeded handling (no data corruption on storage failure)

### External Integrations

- HTTPS enforcement for all API calls
- OAuth token lifecycle (storage, refresh, revocation)
- API key exposure prevention (never log, never include in error messages)
- Response validation (never trust external API responses)

### Dependencies

- Run `npm audit --audit-level=high` — must pass
- Review new dependencies: check maintenance status, download counts, known issues
- Prefer well-maintained, widely-used packages
- Minimize dependency surface area

### Privacy

- No network calls to unexpected endpoints
- No analytics, telemetry, or tracking
- User data must be completely deletable
- PHI awareness in logging/error reporting (no health data in console or error messages)

## Content Security Policy

The app should enforce a strict CSP:

```
default-src 'self';
script-src 'self';
style-src 'self' 'unsafe-inline';
connect-src 'self' https://api.fitbit.com https://*.openweathermap.org;
img-src 'self' data: blob:;
worker-src 'self' blob:;
```

Adjust `connect-src` as integrations are added. Each integration is opt-in.

---
> Converted and distributed by [TomeVault](https://tomevault.io/claim/kabaka) — claim your Tome and manage your conversions.
<!-- tomevault:4.0:skill_md:2026-04-15 -->