security-reviewlisted

Review an application's code for security across frontend AND backend and produce a prioritized, safe-to-apply remediation plan — OWASP Top 10 (2025), OWASP API Top 10, plus privacy (LGPD/GDPR). Use when the user asks for a "security review", "security audit", "harden this", "is this secure?", "check for vulnerabilities", "OWASP", "pentest-style review", or wants a focused security pass on a feature/PR/app (secrets, access control, injection, auth/session, headers/CORS/CSRF, file upload, supply chain, logging, privacy). Applies a strict anti-regression protocol so fixes don't break the app. For designing security up front use threat-modeling; for the always-on security blockers in a normal PR use reviewing-code.
Cristhianzl/claude-skills-czl · ★ 5 · AI & Automation · score 78

Install: claude install-skill Cristhianzl/claude-skills-czl

# Security review Audit the application's code for real vulnerabilities — frontend and backend — and hand back a prioritized, **safe-to-apply** plan. The goal is to shrink the attack surface **without changing what a legitimate user sees or breaking the app**. ## Read first (always) List `learnings/` and read anything relevant. **Reuse, don't re-derive:** - The **always-on blocker set** applied to every PR lives in `../reviewing-code/references/security-checks.md` (PII in logs, injection, HMAC/signature, the AI-generated-code lens). Apply it — don't re-list it. - The **build-time prevention rules** live in `../developing-features/references/security.md` (auth/session, DB least-privilege, TLS, supply chain, and the full AI/LLM guardrails) and `../developing-features/references/untrusted-content.md` (prompt injection). - This skill adds the **OWASP-2025 breadth**, the **frontend / infra / privacy gaps**, and the **safe-remediation protocol** (see `references/`). ## How to run a security review 1. **Scope it.** What are you auditing — a PR, a feature, the whole app? What's the stack (framework, DB, auth provider, does it use AI)? Read `AGENTS.md`/README and grep the code to map the inputs, auth checks, persistence, external calls, and any AI/LLM surface. 2. **Go by priority, top-down** (`references/owasp-2025-checklist.md`): **CRITICAL** (secrets, broken access control / IDOR, injection, password storage) → **HIGH** (auth/session, security headers, CORS/CSRF, crypto, suppl