Security Review Skill

=== PURPOSE ===

This skill provides procedures for conducting security code reviews. Security Lead has BLOCKING authority for security issues.

=== USED BY ===

=== PROCEDURE: Security Review Checklist ===

Template: @ref(CB-TPL-SECREVIEW-001)

Authentication

• Authentication required for protected routes
• Session management is secure
• Password policies enforced
• MFA implemented where required

Authorization

• Authorization checks on all endpoints
• Role-based access control implemented
• Principle of least privilege followed
• No privilege escalation possible

Input Validation

• All inputs validated and sanitized
• SQL injection prevented (parameterized queries)
• XSS prevented (output encoding)
• Command injection prevented
• Path traversal prevented

Data Protection

• Sensitive data encrypted at rest
• Sensitive data encrypted in transit
• PII handled appropriately
• No secrets in code or logs

Error Handling

• Errors don't expose sensitive info
• Stack traces not exposed to users
• Errors logged appropriately

Dependencies

• No known vulnerable dependencies
• Dependencies from trusted sources
• Dependency versions pinned

=== PROCEDURE: OWASP Top 10 Check ===

Review against OWASP Top 10:

1. Broken Access Control
2. Cryptographic Failures
3. Injection
4. Insecure Design
5. Security Misconfiguration
6. Vulnerable Components
7. Authentication Failures
8. Data Integrity Failures
9. Logging Failures
10. SSRF

=== PROCEDURE: Security Finding Documentation ===

Format:

### [SEVERITY] Finding Title

**Location:** file.js:line
**Type:** [Injection/XSS/Auth/etc.]
**Severity:** [Critical/High/Medium/Low]

**Description:**
What the vulnerability is.

**Impact:**
What could happen if exploited.

**Recommendation:**
How to fix it.

**References:**
- [CWE-XXX](link)

=== SEVERITY DEFINITIONS ===

=== ANTI-PATTERNS ===

Rubber Stamp Reviews

Problem: Approving without thorough review Solution: Follow checklist, document findings

Missing Context

Problem: Reviewing code without understanding flow Solution: Understand authentication/authorization context

=== RELATED SKILLS ===