Security Review

Automated security review checklist for code changes. Covers OWASP Top 10, dependency vulnerabilities, secret exposure, and injection vectors.

Checklist

Run against all modified files before commit:

1. Input Validation

• All user inputs validated and sanitized
• SQL queries use parameterized statements (no string concatenation)
• Shell commands use safe argument passing (no interpolation)
• Path traversal prevented (no ../ in user paths)
• File uploads validated (type, size, name)

2. Authentication & Authorization

• Auth checks on all protected endpoints
• Session tokens are cryptographically random
• Password hashing uses bcrypt/argon2 (not MD5/SHA1)
• API keys not hardcoded in source

3. Secrets Management

• No secrets in source code (API keys, passwords, tokens)
• .env files in .gitignore
• Environment variables used for configuration
• No secrets in log output or error messages

4. Dependency Security

• Dependency audit passes
• No known CVEs in dependencies
• Lock files committed and up to date
• Minimal dependency footprint

5. Error Handling

• Error messages don't leak internal details
• Stack traces not exposed to users
• Graceful degradation on failure
• Timeouts configured for external calls

6. Data Protection

• Sensitive data encrypted at rest
• HTTPS enforced for all external communication
• PII handling follows minimum exposure principle
• Logs don't contain sensitive user data

7. Injection Prevention

• XSS: Output encoding applied
• CSRF: Tokens used for state-changing operations
• Command injection: Safe argument passing, no shell interpolation with user data
• SSRF: External URL validation

8. Configuration

• Debug mode disabled in production
• CORS configured restrictively
• Security headers set (CSP, HSTS, X-Frame-Options)
• Rate limiting on sensitive endpoints

Severity Levels

• CRITICAL: Must fix before commit (secrets exposure, SQL injection)
• HIGH: Should fix before merge (missing auth, XSS)
• MEDIUM: Fix in same sprint (missing rate limiting, verbose errors)
• LOW: Track and fix later (minor header issues)