Security Review Skill

This skill ensures all code follows security best practices and identifies potential vulnerabilities.

When to Activate

•Implementing authentication or authorization
•Handling user input or file uploads
•Creating new API endpoints
•Working with secrets or credentials
•Implementing payment features
•Storing or transmitting sensitive data
•Integrating third-party APIs

Security Checklist

1. Secrets Management

NEVER Do This

typescript

const apiKey = "sk-proj-xxxxx"  // Hardcoded secret
const dbPassword = "password123" // In source code

ALWAYS Do This

typescript

const apiKey = process.env.OPENAI_API_KEY
const dbUrl = process.env.DATABASE_URL

// Verify secrets exist
if (!apiKey) {
  throw new Error('OPENAI_API_KEY not configured')
}

Verification Steps

•No hardcoded API keys, tokens, or passwords
•All secrets in environment variables
•.env.local in .gitignore
•No secrets in git history
•Production secrets in hosting platform (Vercel, Railway)

2. Input Validation

Always Validate User Input

typescript

import { z } from 'zod'

// Define validation schema
const CreateUserSchema = z.object({
  email: z.string().email(),
  name: z.string().min(1).max(100),
  age: z.number().int().min(0).max(150)
})

// Validate before processing
export async function createUser(input: unknown) {
  try {
    const validated = CreateUserSchema.parse(input)
    return await db.users.create(validated)
  } catch (error) {
    if (error instanceof z.ZodError) {
      return { success: false, errors: error.errors }
    }
    throw error
  }
}

File Upload Validation

typescript

function validateFileUpload(file: File) {
  // Size check (5MB max)
  const maxSize = 5 * 1024 * 1024
  if (file.size > maxSize) {
    throw new Error('File too large (max 5MB)')
  }

  // Type check
  const allowedTypes = ['image/jpeg', 'image/png', 'image/gif']
  if (!allowedTypes.includes(file.type)) {
    throw new Error('Invalid file type')
  }

  // Extension check
  const allowedExtensions = ['.jpg', '.jpeg', '.png', '.gif']
  const extension = file.name.toLowerCase().match(/\.[^.]+$/)?.[0]
  if (!extension || !allowedExtensions.includes(extension)) {
    throw new Error('Invalid file extension')
  }

  return true
}

Verification Steps

•All user inputs validated with schemas
•File uploads restricted (size, type, extension)
•No direct use of user input in queries
•Whitelist validation (not blacklist)
•Error messages don't leak sensitive info

3. SQL Injection Prevention

NEVER Concatenate SQL

typescript

// DANGEROUS - SQL Injection vulnerability
const query = `SELECT * FROM users WHERE email = '${userEmail}'`
await db.query(query)

ALWAYS Use Parameterized Queries

typescript

// Safe - parameterized query
const { data } = await supabase
  .from('users')
  .select('*')
  .eq('email', userEmail)

// Or with raw SQL
await db.query(
  'SELECT * FROM users WHERE email = $1',
  [userEmail]
)

4. Authentication & Authorization

JWT Token Handling

typescript

// WRONG: localStorage (vulnerable to XSS)
localStorage.setItem('token', token)

// CORRECT: httpOnly cookies
res.setHeader('Set-Cookie',
  `token=${token}; HttpOnly; Secure; SameSite=Strict; Max-Age=3600`)

Authorization Checks

typescript

export async function deleteUser(userId: string, requesterId: string) {
  const requester = await db.users.findUnique({
    where: { id: requesterId }
  })

  if (requester.role !== 'admin') {
    return NextResponse.json(
      { error: 'Unauthorized' },
      { status: 403 }
    )
  }

  await db.users.delete({ where: { id: userId } })
}

Row Level Security (Supabase)

sql

ALTER TABLE users ENABLE ROW LEVEL SECURITY;

CREATE POLICY "Users view own data"
  ON users FOR SELECT
  USING (auth.uid() = id);

CREATE POLICY "Users update own data"
  ON users FOR UPDATE
  USING (auth.uid() = id);

5. XSS Prevention

Sanitize HTML

typescript

import DOMPurify from 'isomorphic-dompurify'

function renderUserContent(html: string) {
  const clean = DOMPurify.sanitize(html, {
    ALLOWED_TAGS: ['b', 'i', 'em', 'strong', 'p'],
    ALLOWED_ATTR: []
  })
  return <div dangerouslySetInnerHTML={{ __html: clean }} />
}

Content Security Policy

typescript

// next.config.js
const securityHeaders = [
  {
    key: 'Content-Security-Policy',
    value: `
      default-src 'self';
      script-src 'self' 'unsafe-eval' 'unsafe-inline';
      style-src 'self' 'unsafe-inline';
      img-src 'self' data: https:;
      font-src 'self';
      connect-src 'self' https://api.example.com;
    `.replace(/\s{2,}/g, ' ').trim()
  }
]

6. CSRF Protection

typescript

import { csrf } from '@/lib/csrf'

export async function POST(request: Request) {
  const token = request.headers.get('X-CSRF-Token')

  if (!csrf.verify(token)) {
    return NextResponse.json(
      { error: 'Invalid CSRF token' },
      { status: 403 }
    )
  }
}

7. Rate Limiting

typescript

import rateLimit from 'express-rate-limit'

const limiter = rateLimit({
  windowMs: 15 * 60 * 1000, // 15 minutes
  max: 100, // 100 requests per window
  message: 'Too many requests'
})

app.use('/api/', limiter)

8. Sensitive Data Exposure

Logging

typescript

// WRONG: Logging sensitive data
console.log('User login:', { email, password })

// CORRECT: Redact sensitive data
console.log('User login:', { email, userId })

Error Messages

typescript

// WRONG: Exposing internal details
catch (error) {
  return NextResponse.json(
    { error: error.message, stack: error.stack },
    { status: 500 }
  )
}

// CORRECT: Generic error messages
catch (error) {
  console.error('Internal error:', error)
  return NextResponse.json(
    { error: 'An error occurred. Please try again.' },
    { status: 500 }
  )
}

9. Dependency Security

bash

# Check for vulnerabilities
npm audit

# Fix automatically fixable issues
npm audit fix

# Use in CI/CD for reproducible builds
npm ci

Pre-Deployment Security Checklist

Before ANY production deployment:

•Secrets: No hardcoded secrets, all in env vars
•Input Validation: All user inputs validated
•SQL Injection: All queries parameterized
•XSS: User content sanitized
•CSRF: Protection enabled
•Authentication: Proper token handling
•Authorization: Role checks in place
•Rate Limiting: Enabled on all endpoints
•HTTPS: Enforced in production
•Security Headers: CSP, X-Frame-Options configured
•Error Handling: No sensitive data in errors
•Logging: No sensitive data logged
•Dependencies: Up to date, no vulnerabilities
•CORS: Properly configured
•File Uploads: Validated (size, type)

Resources

Remember: Security is not optional. One vulnerability can compromise the entire platform.