/security-review-checklists

name: security-review-checklists
description: "OWASP Top 10, STRIDE threat modeling, and auth/compliance review checklists. TRIGGER when: reviewing code for vulnerabilities, threat-modeling a feature, or auditing auth. SKIP: general code-quality review (use pattern-recognition); test coverage review (use testing-strategy)."

OWASP Top 10 Checklist

| Vulnerability | Check | |---------------|-------| | Injection | Parameterized queries, input validation | | Broken Auth | Session management, MFA where needed | | Sensitive Data | Encryption, no logging PII | | XXE | Disable external entities in XML | | Broken Access | Authorization on all endpoints | | Misconfiguration | Secure defaults, no debug in prod | | XSS | Output encoding, CSP headers | | Insecure Deserialization | Validate before deserialize | | Vulnerable Components | Check dependencies | | Logging | Audit trails, no sensitive data in logs |

STRIDE Threat Modeling

| Threat | Check For | |--------|-----------| | **S**poofing | Authentication weaknesses | | **T**ampering | Data integrity issues | | **R**epudiation | Missing audit logs | | **I**nfo Disclosure | Data exposure risks | | **D**enial of Service | Rate limiting gaps | | **E**levation | Authorization bypasses |

Authentication Review

| Aspect | Requirements | |--------|--------------| | Password policy | Min length, complexity, no common passwords | | Token handling | Secure storage, expiration, refresh | | Session mgmt | Timeout, invalidation, secure cookies | | MFA | Available for sensitive operations |

Authorization Review

| Pattern | Check | |---------|-------| | RBAC | Roles properly defined and enforced | | Resource access | Per-resource authorization | | Least privilege | Minimal permissions granted | | Default deny | Explicit grants required |

Data Protection Review

| Data State | Requirement | |------------|-------------| | In transit | TLS 1.2+ | | At rest | AES-256 encryption | | In logs | No PII, no secrets | | In errors | No stack traces to users |

Compliance Quick Check

| Framework | Key Requirements | |-----------|-----------------| | GDPR | Consent, data minimization, deletion | | HIPAA | PHI encryption, access controls | | PCI DSS | Cardholder data protection | | SOC 2 | Security controls, audit |

Input Validation Rules

| Data Type | Validation | |-----------|------------| | Email | Regex pattern, max 255 chars | | Password | Min 8 chars, upper + lower + number + special | | URL | Protocol whitelist (https only) | | File upload | Extension whitelist, MIME check, size limit | | IDs | UUID format or positive integer | | Free text | Max length, HTML sanitization |

Validate server-side always. Whitelist over blacklist. Fail fast.

Bundled References

Printable checklists in `references/` for use during code reviews:

| File | Description | |------|-------------| | `references/owasp-checklist.md` | OWASP Top 10 (2021) with actionable checkboxes per category | | `references/auth-checklist.md` | Authentication and authorization review with JWT, RBAC, and session checks |

Copy checklist items into PR review comments or use as a gate before merging security-sensitive changes.

JWT Token Standards

| Token | Expiry | Storage | |-------|--------|---------| | Access | 15 minutes | HttpOnly cookie | | Refresh | 7 days | HttpOnly cookie |

Include `iat`, `exp`, `sub` claims. Sign with RS256 or HS256. Never store in localStorage.

Rate Limiting Defaults

| Endpoint Type | Limit | |---------------|-------| | Login | 5/minute | | Password reset | 3/hour | | API general | 100/minute | | File upload | 10/minute |

Return headers: `X-RateLimit-Limit`, `X-RateLimit-Remaining`, `X-RateLimit-Reset`, `Retry-After` (on 429).

Security Headers

| Header | Value | |--------|-------| | X-Content-Type-Options | nosniff | | X-Frame-Options | DENY | | Strict-Transport-Security | max-age=31536000; includeSubDomains | | Content-Security-Policy | default-src 'self' | | Referrer-Policy | strict-origin-when-cross-origin |

CORS Configuration

Never use `*` origin in production. Whitelist specific origins. Limit allowed methods and headers. Set `Access-Control-Max-Age: 600`.