security-review

# Security Review Systematic security checklist for code changes. Catch vulnerabilities before they ship. ## When to Use - After writing authentication or authorization code - After handling user input (forms, query params, file uploads) - After creating or modifying API endpoints - After touching secrets, tokens, or credentials - Before any commit that touches security-sensitive code ## Procedure ### Step 1: Identify Scope Determine which checks apply based on changed files: - Auth code: full checklist - API endpoints: input validation, injection, rate limiting - Frontend: XSS, CSRF - Config/infra: secrets, permissions ### Step 2: Run Checklist | Check | Severity | What to Look For | |-------|----------|------------------| | Hardcoded secrets | CRITICAL | API keys, passwords, tokens in source | | SQL injection | CRITICAL | String concatenation in queries | | Auth bypass | CRITICAL | Missing auth checks on protected routes | | XSS | HIGH | Unsanitized user input in HTML output | | CSRF | HIGH | Missing CSRF tokens on state-changing requests | | Input validation | HIGH | Unvalidated user input passed to logic | | Rate limiting | MEDIUM | Endpoints without rate limits | | Error leaks | MEDIUM | Stack traces or internal details in responses | | Authz checks | HIGH | Missing permission verification | | Dependency vulns | MEDIUM | Known CVEs in dependencies | ### Step 3: Scan Code ```bash # Check for hardcoded secrets (patterns) g...