Security Review

Aim for findings that are exploitable, reproducible and fixable. Every finding needs a location, a scenario, a severity and a remediation. A wall of theoretical warnings is not a review.

Scope first

1. State what is in scope (whole repo, a PR diff, one feature) and the threat model in two lines: who are the attackers (anonymous internet, authenticated users, other tenants, insiders, a compromised dependency) and what are the crown jewels (user data, money, credentials, admin access).
2. Map the attack surface: routes/handlers, server actions, webhooks, background jobs, file uploads, CLI entry points, environment/config, third-party integrations, and any place LLM output or prompts touch code or tools.

Automated pass (fast, do it first)

semgrep --config auto --json -o semgrep.json .        # if available
npm audit --omit=dev || pip-audit || cargo audit || go vuln ./...
gitleaks detect --no-git -v || trufflehog filesystem .
rg -n "(password|secret|api[_-]?key|token)\s*[:=]\s*['\"][^'\"]{8,}" --glob '!*.lock'
rg -n "eval\(|exec\(|child_process|subprocess|os\.system|dangerouslySetInnerHTML|innerHTML\s*="
rg -n "(SELECT|INSERT|UPDATE|DELETE).*(\+|\$\{|%s|f\")"   # string-built SQL

Triage tool output; do not paste it raw. False positives get dismissed with one line of reasoning.

Manual review checklist

Authentication and sessions

• Password hashing (argon2id/bcrypt), rate limits and lockout on login, MFA where sensitive.
• Session/JWT: signing key strength, expiry, revocation path, HttpOnly; Secure; SameSite cookies, no tokens in URLs or logs.
• OAuth: state and PKCE used, redirect URIs allow-listed.