securitylisted

# Security Review Perform a focused security analysis of changed code. Do not modify any files. ## Step 1: Get the target ```bash git diff --staged ``` If nothing staged: ```bash git diff HEAD ``` If `$ARGUMENTS` provides a file path → review that file specifically. If diff is empty and no argument → ask: "What should I review? (staged changes, a specific file, or a path)" ## Step 2: Read full context For each changed file, read the complete file — not just the diff. Security issues often live in the surrounding code, not the changed lines. ## Step 3: Security checklist Work through each category. Report only findings that apply. ### Injection - **SQL injection** — unparameterized queries: string concatenation or interpolation into SQL ``` `SELECT * WHERE id = ${input}` ← vulnerable db.query('SELECT * WHERE id = $1', [input]) ← safe ``` - **Command injection** — user input in shell commands: `exec()`, `spawn()`, `eval()`, `system()` - **Path traversal** — user-controlled file paths without sanitization: `../` sequences, absolute path injection - **Template injection** — user input rendered in server-side templates without escaping - **NoSQL injection** — unvalidated objects passed directly to MongoDB/similar query operators ### Authentication & authorization - **Missing auth check** — new endpoints or routes without authentication middleware/guard - **Broken authorization** — accessing records by ID without verifying ownership ``` GET /invoices/:id → fe