Security Review

When reviewing code for security issues, check each category below. Reference the detailed checklist in references/security-checklist.md.

Injection Vulnerabilities

• •SQL injection: Look for string concatenation in database queries
• •Command injection: Check for unsanitized input passed to shell commands (exec, spawn)
• •XSS: Look for unsanitized user input rendered in HTML/templates
• •Path traversal: Check for user input in file paths without sanitization

Authentication & Authorization

• •Verify authentication checks on protected routes/endpoints
• •Ensure authorization checks match the required access level
• •Look for privilege escalation paths (e.g., user can modify other users' data)
• •Check that password/token comparison uses constant-time comparison

Secrets & Credentials

• •Hardcoded API keys, passwords, tokens, or connection strings
• •Secrets in configuration files that might be committed
• •Sensitive data in logs or error messages
• •Credentials passed via URL query parameters

Input Validation

• •Validate and sanitize all external input (user input, API responses, file contents)
• •Check for missing or weak input validation on API endpoints
• •Verify type coercion doesn't bypass validation
• •Look for overly permissive CORS or CSP configurations

Data Exposure

• •Sensitive data returned in API responses unnecessarily
• •PII or secrets in application logs
• •Information leakage in error messages (stack traces, internal paths)
• •Missing data encryption for sensitive fields

Severity Levels

• •🔴 CRITICAL: Exploitable vulnerability (injection, auth bypass, exposed secrets)
• •🟠 HIGH: Potential vulnerability that needs investigation
• •🟡 MEDIUM: Security weakness or missing best practice
• •🔵 LOW: Minor security improvement suggestion