security-review

1# Security Review
2 
3Find vulnerabilities before they ship.
4 
5## Hard Rules
6 
7- Do not dismiss a finding without evidence it is unexploitable.
8- Do not commit, log, or surface secrets discovered during review — flag and recommend rotation.
9- Do not modify code until the user approves a remediation plan.
10 
11## Workflow
12 
131. **Scope**
14   - Confirm target: diff, file set, module, full repo, or skill/prompt. A target can be both code and prompt.
15   - Identify stack/framework — adapt the [checklist](references/checklist.md) (skip what the framework handles, add its pitfalls).
16   - Trace data flow: request → middleware → handler → service → datastore → response. For prompts: input → template → LLM → tools → output.
17   - Map trust boundaries, privilege levels, and threat actors.
18   - Search prior findings: `npx ai-devkit@latest memory search --query "<target>" --tags "security"`
19 
202. **Scan**
21   - Only check relevant categories. Skip sections and items that don't apply. Do not report skipped items.
22   - For diffs/PRs: also check whether the change weakens existing controls — removed middleware, bypassed validation, new unprotected routes.
23   - Categories in priority order:
24     a. **Secrets** — hardcoded tokens, keys, connection strings.
25     b. **Injection** — SQL, NoSQL, command, template, SSRF, path traversal, XSS.
26     c. **Auth** — missing checks, privilege escalation, OAuth/OIDC, IDOR.
27…