This skill ensures all code follows security best practices and identifies potential vulnerabilities. Use when implementing authentication or authorization, handling user input or file uploads, or creating new API endpoints.

Security Review Skill This skill guides review of security practices and potential vulnerabilities; no checklist ensures all code is secure. Detailed Guide Read [the detailed guide](references/detailed guide.md) before executing this skill. It retains the complete procedure and reference material. Treat its safety, prerequisites, and validation requirements as mandatory. For focused work, load the relevant sections; for end to end work, read the guide completely. When to Use Implementing authentication or authorization Handling user input or file uploads Creating new API endpoints Working with secrets or credentials Implementing payment features Storing or transmitting sensitive data Integrating third party APIs Security Checklist 1. Secrets Management ❌ NEVER Do This ✅ ALWAYS Do This Verification Steps [ ] No hardcoded API keys, tokens, or passwords [ ] All secrets in environment variables [ ] .env.local in .gitignore [ ] No secrets in git history [ ] Production secrets in hosting platform (Vercel, Railway) 2. Input Validation Always Validate User Input File Upload Validation Verification Steps [ ] All user inputs validated with schemas [ ] File uploads restricted (size, type, extension) [ ] No direct use of user input in queries [ ] Whitelist validation (not blacklist) [ ] Error messages don't leak sensitive info 3. SQL Injection Prevention ❌ NEVER Concatenate SQL ✅ ALWAYS Use Parameterized Queries Verification Steps [ ] All database queries use parameterized queries [ ] No string concatenation in SQL [ ] ORM/query builder used correctly [ ] Supabase queries properly sanitized 4. Authentication & Authorization JWT Token Handling Authorization Checks Row Level Security (Supabase) Verification Steps [ ] Tokens stored in httpOnly cookies (not localStorage) [ ] Authorization checks before sensitive operations [ ] Row Level Security enabled in Supabase [ ] Role based access control implemented [ ] Session management secure 5. XSS Prevention Sanitize HTML Content Security Policy Verification Steps [ ] User provided HTML sanitized [ ] CSP headers configured [ ] No unvalidated dynamic content rendering [ ] React's built in XSS protection used 6. CSRF Protection CSRF Tokens SameSite Cookies Verification Steps [ ] CSRF tokens on state changing operations [ ] SameSite policy fits the flow; test OAuth redirects and CSRF controls [ ] Use a vetted synchronizer or signed session bound double submit pattern where required 7. Rate Limiting API Rate Limiting Expensive Operations Verification Steps [ ] Rate limiting on all API endpoints [ ] Stricter limits on expensive operations [ ] IP based rate limiting [ ] User based rate limiting (authenticated) 8. Sensitive Data Exposure Logging Error Messages Verification Steps [ ] No passwords, tokens, or secrets in logs [ ] Error messages generic for users [ ] Detailed errors only in server logs [ ] No stack traces exposed to users 9. Blockchain Security (Solana) Wallet Verification Application Intent Validation (not a Solana Transaction API) Verification Steps [ ] Wallet signatures verified [ ] Transaction details validated [ ] Balance checks before transactions [ ] No blind transaction signing 10. Dependency Security Regular Updates Lock Files Verification Steps [ ] Dependencies up to date [ ] No known vulnerabilities (npm audit clean) [ ] Lock files committed [ ] Dependabot enabled on GitHub [ ] Regular security updates Security Testing Automated Security Tests Limitations Use this skill only when the task clearly matches the scope described above. Do not treat the output as a substitute for environment specific validation, testing, or expert review. Stop and ask for clarification if required inputs, permissions, safety boundaries, or success criteria are missing. Derive requester identity from a verified server session, never a caller supplied requesterId. Browser MIME/extension checks are only usability filters: enforce server byte limits, inspect/decode file content, and store with safe names/origins. Use a cookie serializer and deliberate Path/Domain; HttpOnly does not prevent XSS from issuing requests. Adapt CSP with per response nonces/hashes and real Next.js header wiring rather than adding unsafe inline/eval. For wallet login, bind a server issued single use nonce, domain, purpose and expiry and consume it atomically; signature validity alone permits replay. The transaction intent sketch does not decode or validate actual Solana instructions, fees, programs, token mints or confirmation. Pin dependencies, validate codemods/audit fixes on a branch, and report accepted findings rather than equating audit clean with security. Tests are illustrative and rate tests require bounded authorized fixtures.

cc-skill-security-review