Security Review

Source: affaan-m/everything-claude-code Original files: agents/security-reviewer.md + skills/security-review/SKILL.md + rules/common/security.md Category: E-Security

Security Reviewer Agent

Core Responsibilities

1. Vulnerability Detection — OWASP Top 10 and common security issues
2. Secrets Detection — Hardcoded API keys, passwords, tokens
3. Input Validation — Proper sanitization of all user inputs
4. Authentication/Authorization — Access control verification
5. Dependency Security — Vulnerable package detection
6. Secure Coding Patterns — Enforcement of best practices

Review Workflow

Step 1: Initial Scan

• Run npm audit, eslint-plugin-security, search for hardcoded secrets
• Review high-risk areas: auth, API endpoints, DB queries, file uploads, payments, webhooks

Step 2: OWASP Top 10 Check

Step 3: Code Pattern Flags

Key Principles

1. Defense in Depth — Multiple security layers
2. Least Privilege — Minimum required permissions
3. Fail Securely — Errors must not expose data
4. Don't Trust Input — Validate and sanitize everything
5. Update Regularly — Keep dependencies current

Security Checklist

1. Secrets Management

// NEVER: Hardcoded secrets
const apiKey = "sk-proj-xxxxx"

// ALWAYS: Environment variables with validation
const apiKey = process.env.OPENAI_API_KEY
if (!apiKey) throw new Error('OPENAI_API_KEY not configured')

2. Input Validation (Zod)

import { z } from 'zod'

const CreateUserSchema = z.object({
  email: z.string().email(),
  name: z.string().min(1).max(100),
  age: z.number().int().min(0).max(150)
})

export async function createUser(input: unknown) {
  const validated = CreateUserSchema.parse(input)
  return await db.users.create(validated)
}

3. SQL Injection Prevention

// SAFE: Parameterized queries
const { data } = await supabase.from('users').select('*').eq('email', userEmail)

// Or raw SQL with parameters
await db.query('SELECT * FROM users WHERE email = $1', [userEmail])

4. Authentication & Authorization

• Store tokens in httpOnly cookies (never localStorage)
• Check authorization before every sensitive operation
• Enable Row Level Security in Supabase
• Implement RBAC

5. XSS Prevention

• Sanitize user HTML with DOMPurify
• Configure Content Security Policy headers
• Use framework auto-escaping (React)

6. CSRF Protection

• CSRF tokens on state-changing operations
• SameSite=Strict on all cookies

7. Rate Limiting

• Apply rate limits on all API endpoints
• Stricter limits on expensive operations (search, uploads)

8. Sensitive Data

• Never log passwords, tokens, or secrets
• Generic error messages for users; detailed errors in server logs only

9. Dependency Security

• Run npm audit regularly
• Commit lock files
• Enable Dependabot

When to Run

Always: New API endpoints, auth changes, user input handling, DB query changes, file uploads, payment code, external API integrations, dependency updates.

Immediately: Production incidents, dependency CVEs, user security reports, before major releases.

Pre-Deployment Checklist

• No hardcoded secrets
• All inputs validated
• All queries parameterized
• User content sanitized (XSS)
• CSRF protection enabled
• Proper token handling
• Role checks in place
• Rate limiting on all endpoints
• HTTPS enforced
• Security headers configured (CSP, X-Frame-Options)
• No sensitive data in errors or logs
• Dependencies up to date
• RLS enabled (Supabase)
• CORS properly configured

Common False Positives

• Environment variables in .env.example
• Test credentials clearly marked in test files
• Intentionally public API keys
• SHA256/MD5 for checksums (not passwords)

Remember: Security is not optional. One vulnerability can compromise the entire platform.