security-review
Interactive browser-based AppSec training game where players identify vulnerabilities in code and learn secure coding practices
- Category: discovered
- Tags: github, community
- Version: 1.0.0
- Author: walid
- Downloads: 0
- GitHub stars: 2
- Updated: 2025-11-21
Download the latest version (v1.0.0) from this page.
SKILL.md
# Security Review Skill ## Activation Context Activates when reviewing code for security issues, implementing security features, or discussing security concerns. ## When to Invoke security-engineer Agent - **REQUIRED** for ALL pull request reviews - Implementing authentication/authorization - Handling sensitive data - Integrating third-party services - Reviewing security incidents - Conducting security audits ## Security Review Checklist ### Authentication & Authorization - [ ] Passwords hashed with bcrypt/Argon2 - [ ] Session management secure - [ ] JWT tokens properly validated - [ ] Authorization checks on all protected routes - [ ] MFA implemented where appropriate - [ ] Password reset flow secure ### Input Validation - [ ] All user inputs validated - [ ] SQL injection prevention (parameterized queries) - [ ] XSS prevention (output escaping) - [ ] CSRF tokens implemented - [ ] File upload validation (type, size, content) - [ ] Rate limiting on sensitive endpoints ### Data Protection - [ ] Sensitive data encrypted at rest - [ ] TLS/SSL for data in transit - [ ] No sensitive data in logs - [ ] Secrets in environment variables only - [ ] PII handled according to regulations (GDPR, etc.) - [ ] Secure key management ### OWASP Top 10 Review 1. **Broken Access Control**: Verify authorization on all resources 2. **Cryptographic Failures**: Check encryption implementation 3. **Injection**: Validate SQL, command, and other injection points 4. **Insecure Design**: Review architecture for security 5. **Security Misconfiguration**: Check secure defaults 6. **Vulnerable Components**: Scan dependencies 7. **Authentication Failures**: Verify auth implementation 8. **Data Integrity Failures**: Check data validation 9. **Logging Failures**: Ensure security events logged 10. **SSRF**: Validate external resource access ## Coordination Protocol ### PR Security Review Process 1. Automated security scans must pass first 2. Review code changes for security implications 3. Check for hardcoded secrets or credentials 4. Verify input validation on new endpoints 5. Confirm authentication/authorization logic 6. Approve or request changes 7. Re-review after changes ### Handoff Points - **From all engineers**: Code PRs for security review (mandatory) - **To devsecopsengineer**: Security automation and CI/CD integration - **To qa-engineer**: Security test scenarios - **To documentation-engineer**: Security best practices documentation ## Security Incident Response If security vulnerability found: 1. **Assess severity**: Critical/High/Medium/Low 2. **Create private security advisory** (don't expose publicly) 3. **Notify stakeholders** immediately for Critical/High 4. **Develop fix** with relevant engineer 5. **Test fix** thoroughly 6. **Deploy fix** as hotfix if needed 7. **Document incident** and lessons learned ## Common Vulnerabilities to Check ### Backend Code - SQL injection in database queries - Command injection in system calls - Path traversal in file operations - Insecure deserialization - XXE (XML External Entity) attacks - Server-side request forgery (SSRF) ### Frontend Code - XSS in user-generated content - DOM-based XSS - Insecure direct object references - Sensitive data exposure in client code - Insecure client-side storage ### Infrastructure (with devsecopsengineer) - Exposed secrets in code/configs - Weak TLS configuration - Open ports and services - Default credentials - Unpatched dependencies ## Tools Integration - Static analysis: ESLint security plugins, Semgrep - Dependency scanning: npm audit, Snyk - Secret detection: TruffleHog, git-secrets - DAST: OWASP ZAP - Container scanning: Trivy ## Best Practices - Security is everyone's responsibility, but security-engineer has final say - Review security for EVERY PR before merge - Keep dependencies updated - Follow principle of least privilege - Defense in depth - Fail securely (deny by default)