📘

Security Review

Review changes for security before merge.

v1 security curated

🤖

Install 安装

curl -sSL https://updating.cc/skills/security/security-review/SKILL.md -o ~/.agents/skills/security__security-review/SKILL.md

📄

Raw Source

https://updating.cc/skills/security/security-review/SKILL.md

← Back to profession page

SKILL.md Preview 技能内容预览

---
name: Security Review
description: Review changes for security before merge.
---
# Security Review

Security review catches issues at design and PR time, when they're cheap. Waiting for the penetration test means finding them at production-time, when they're expensive and already deployed.

## At design time
- Walk the threat model for new features. What new trust boundaries? What new data flows?
- Question new dependencies. Each one is supply-chain risk. Is it maintained? Widely used? Does it need the permissions it asks for?

## At PR time
- **Input handling.** Every new input from a user or service — validated, sanitized, parameterized?
- **Authz on new endpoints.** Does this check the caller can access this resource? IDOR check.
- **Secrets handling.** Any new secret logged, embedded, or shipped in a response?
- **Crypto.** New crypto must use vetted libraries and modes, not hand-rolled. Homebrew crypto is a vulnerability.

## Spirit
Reviewers are allies, not gatekeepers. The goal is shipping secure code, not blocking shipping.