Security Code Review Skill — Reviewer & Quality Gatekeeper
Overview
This skill provides comprehensive guidance for security code reviews following OWASP Top 10 standards. It covers vulnerability detection, secure coding standards, authentication/authorization patterns, and vulnerability remediation following CSSLP and CISSP certification standards.
When to Use
Use this skill when:
- Performing security code reviews
- Reviewing code for OWASP Top 10 vulnerabilities
- Checking authentication and authorization implementations
- Reviewing API security implementations
- Analyzing input validation and sanitization
- Checking cryptographic implementations
- Reviewing session management
- Analyzing error handling for information disclosure
- Checking for security misconfigurations
- Reviewing dependency security
- Analyzing logging and monitoring for security events
- Checking for injection vulnerabilities
- Reviewing file upload and access controls
- Analyzing business logic vulnerabilities
- Checking for insecure direct object references
- Reviewing cross-site scripting (XSS) vulnerabilities
- Analyzing cross-site request forgery (CSRF) protections
- Checking for sensitive data exposure
- Reviewing security headers and CSP
- Analyzing rate limiting and DDoS protections
- Checking for insecure deserialization
- Reviewing security configuration management
- Analyzing mobile app security patterns
Do NOT use this skill when:
- Writing application business logic (use domain-driven skill)
- Designing database schemas (use database-design skill)
- Writing API endpoint specifications (use api-design skill)
- Performing general code review (use code-review skill)
- Writing SQL queries (use sql-best-practices skill)
- Designing multi-page website layouts (use design-system skill)
- Analyzing deployment configurations (use deployment skill)
- Writing documentation (use documentation-best-practices skill)
OWASP Top 10 (2025) Checklist
A01: Broken Access Control
[ ] Direct object references protected [ ] Role-based access enforced at every endpoint [ ] Admin functions require admin privileges [ ] API endpoints validate ownership of resources [ ] CORS properly configured [ ] Authorization checks on all endpoints [ ] Role hierarchy properly enforced [ ] Permission inheritance correct [ ] Default permissions secure [ ] Session-based access controls
A02: Cryptographic Failures
[ ] Passwords hashed with bcrypt/scrypt/argon2 [ ] TLS used for all data in transit [ ] Sensitive data encrypted at rest [ ] No hardcoded secrets or keys [ ] Strong key management practices [ ] Secure random number generation [ ] Proper cipher modes (GCM, CCM) [ ] Key rotation implemented [ ] Certificate validation enforced [ ] No self-signed certificates in production
A03: Injection
[ ] Parameterized queries for all database access [ ] Input validation on all user-supplied data [ ] Output encoding for all rendered content [ ] Command execution sanitized [ ] File path traversal prevented [ ] LDAP injection prevented [ ] XML injection prevented [ ] SMTP injection prevented [ ] OS command injection prevented [ ] Template injection prevented
A04: Insecure Design
[ ] Threat modeling performed [ ] Security requirements defined [ ] Rate limiting implemented [ ] Secure defaults used [ ] Defense in depth applied [ ] Secure by design principles followed [ ] Security requirements traceable [ ] Threat models updated with changes [ ] Security architecture documented [ ] Security design patterns used
A05: Security Misconfiguration
[ ] Default credentials changed [ ] Unnecessary features disabled [ ] Error messages don't leak info [ ] Security headers present (CSP, HSTS, X-Frame) [ ] Debug mode disabled in production [ ] Server version hidden [ ] Directory listing disabled [ ] Security headers on all responses [ ] Configuration management system [ ] Environment-specific configs
A06: Vulnerable Components
[ ] Dependencies audited for CVEs [ ] Packages updated to latest stable [ ] Unused dependencies removed [ ] Lock file integrity verified [ ] Dependency scanning in CI/CD [ ] Known vulnerable versions identified [ ] Security patches applied quickly [ ] Dependency tree analyzed [ ] Transitive dependencies checked [ ] Supply chain security verified
A07: Auth Failures
[ ] Multi-factor authentication available [ ] Account lockout after failed attempts [ ] Session management secure [ ] Password policy enforced [ ] Token expiration reasonable [ ] Session fixation prevented [ ] Token binding implemented [ ] Password strength requirements [ ] Password reset secure [ ] Brute force protection
A08: Data Integrity Failures
[ ] Deserialization validated [ ] Digital signatures verified [ ] CI/CD pipeline secured [ ] Supply chain verified [ ] Code signing implemented [ ] Artifact integrity verified [ ] Build process secure [ ] Dependency integrity checked [ ] Container image signing [ ] Software supply chain security
A09: Logging & Monitoring Failures
[ ] Security events logged [ ] Logs don't contain sensitive data [ ] Alerting configured for anomalies [ ] Incident response plan exists [ ] Log integrity protected [ ] Log retention policy [ ] Real-time monitoring [ ] SIEM integration [ ] Alert thresholds set [ ] Log analysis automated
A10: Server-Side Request Forgery
[ ] URL validation on server-side requests [ ] Allowlist for external domains [ ] Network segmentation enforced [ ] Response filtering applied [ ] DNS rebinding protection [ ] SSRF protection implemented [ ] Internal network access blocked [ ] User-supplied URLs validated [ ] HTTP client security configured [ ] Proxy configuration secure
Secure Coding Standards
Input Validation
typescript// ✅ Good: Input validation const schema = z.object({ email: z.string().email().max(254), password: z.string().min(12).max(128), name: z .string() .min(1) .max(100) .regex(/^[a-zA-Z\s'-]+$/), age: z.number().int().min(0).max(150), }); // ❌ Bad: No validation const user = req.body; // Unvalidated input
Output Encoding
typescript// ✅ Good: Output encoding const safeHtml = escapeHtml(userInput); const safeJson = JSON.stringify(data); // ❌ Bad: No encoding res.send(`<div>${userInput}</div>`); // XSS vulnerability
Password Security
typescript// ✅ Good: Secure password handling const hashedPassword = await bcrypt.hash(password, 12); // ❌ Bad: Plain text or weak hashing const hashed = md5(password); // Weak hashing
Severity Classification
| Level | CVSS | Example | Response Time |
|---|---|---|---|
| Critical | 9.0+ | SQL Injection, RCE | Immediate |
| High | 7.0-8.9 | Auth bypass, XSS | < 24 hours |
| Medium | 4.0-6.9 | Info disclosure, CSRF | < 1 week |
| Low | 0.1-3.9 | Missing headers | Next release |
Security Headers Checklist
Content-Security-Policy: default-src 'self' Strict-Transport-Security: max-age=31536000; includeSubDomains X-Content-Type-Options: nosniff X-Frame-Options: DENY X-XSS-Protection: 0 Referrer-Policy: strict-origin-when-cross-origin Permissions-Policy: camera=(), microphone=(), geolocation=() Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache
Authentication Patterns
JWT Best Practices
typescript// ✅ Good: Secure JWT handling const token = jwt.sign( { userId: user.id, roles: user.roles }, process.env.JWT_SECRET, { expiresIn: '15m', algorithm: 'RS256', } ); // ❌ Bad: Insecure JWT const token = jwt.sign({ userId: user.id }, 'secret'); // Weak secret
Session Management
typescript// ✅ Good: Secure session handling app.use( session({ secret: process.env.SESSION_SECRET, resave: false, saveUninitialized: false, cookie: { secure: true, httpOnly: true, sameSite: 'strict', maxAge: 3600000, }, }) );
Real-World Impact
Before this skill:
- Security vulnerabilities in code
- OWASP Top 10 vulnerabilities present
- Authentication/authorization issues
- Sensitive data exposure
- Injection vulnerabilities
After this skill:
- Secure code following best practices
- OWASP Top 10 vulnerabilities addressed
- Proper authentication/authorization
- Data protected in transit and at rest
- Secure input validation and output encoding
Cross-References
security-auditor- For comprehensive security auditsthreat-modeling- For threat modeling integrationdevops-pipeline- For security CI/CD gates
