/security-review

name: security-review
description: Apply when performing a security review, checking for vulnerabilities, or implementing authentication and authorization logic.
license: MIT
version: 1.0.0
tokens_target: 2200
triggers:
  - security review
  - vulnerability check
  - auth implementation
loads_after: [code-quality]
supersedes: []

Sub-Skill: Security Review Depth

<!-- target: tokens_target above. Run `python tools/render_readme_table.py` to update README. -->

**Purpose:** Deep security rules for authentication, authorization, injection, session management, and API hardening. Complements code-quality rules 20–23 with IDOR, SSRF, and access-control depth.

---

Rules

Authentication vs. Authorization

1. **AuthN/AuthZ separation.** Always treat authentication (who are you?) and authorization (what can you do?) as distinct checks; never collapse them into a single boolean `is_logged_in` guard. 2. **Resource ownership check.** Always verify resource ownership in addition to role-based access on mutation endpoints — a valid role does not imply ownership of the target record. Reference: ERR-2026-019 3. **IDOR prevention.** Never expose sequential or predictable resource IDs in URLs without a server-side ownership assertion; use opaque UUIDs and always re-fetch the record to confirm the caller owns it. 4. **Privilege escalation guard.** Never allow a user to elevate their own role or grant permissions they do not already hold; enforce privilege changes through a separate admin-only path. 5. **Token scope enforcement.** Always validate that the token's declared scope covers the requested operation before executing it; reject tokens with insufficient scope with 403, not 401.

Session Management

6. **Session fixation prevention.** Always regenerate the session identifier immediately after a successful login to prevent session fixation attacks. 7. **Idle and absolute timeouts.** Ensure sessions carry both an idle timeout (e.g., 15 min) and an absolute expiry (e.g., 8 h); never issue non-expiring session tokens. 8. **Secure cookie attributes.** Always set `HttpOnly`, `Secure`, and `SameSite=Strict` (or `Lax`) on session cookies; never omit any of these three attributes. 9. **Logout invalidation.** Always invalidate the server-side session record on logout; never rely solely on deleting the client-side cookie.

Injection and Input Handling

10. **Parameterized queries everywhere.** Never construct database queries by string concatenation with user-supplied values; always use parameterized statements or an ORM that enforces binding. 11. **Output encoding context.** Always encode output in the context where it will be rendered (HTML entity encoding for HTML, JSON encoding for JSON responses, URL encoding for query strings); never apply a single generic escape. 12. **SSRF mitigation.** Before making any server-side HTTP request to a URL derived from user input, validate the resolved IP against an allowlist; block private RFC-1918 ranges and loopback addresses. 13. **File path traversal.** Never concatenate user input into file system paths; always resolve the canonical path and assert it falls within the expected base directory before opening.

API and Transport Hardening

14. **CORS allowlist.** Avoid wildcard `Access-Control-Allow-Origin: *` on endpoints that return authenticated data; always enumerate trusted origins explicitly. 15. **CSP header.** Ensure every HTML response includes a `Content-Security-Policy` header that restricts `script-src` to known origins; never use `unsafe-inline` without a nonce or hash. 16. **Rate limiting on auth endpoints.** Always apply rate limiting and exponential back-off to login, password-reset, and OTP endpoints; never expose them without request throttling. 17. **Sensitive data in logs.** Never log passwords, tokens, full credit-card numbers, or other PII; mask or omit them before writing to any log sink.

Secrets and Dependencies

18. **Secret rotation readiness.** Always design secret consumption so that rotating a credential requires only an environment variable update with no code change; never hard-code secrets or embed them in config files committed to version control. 19. **Dependency CVE scan.** Before merging any PR that adds or upgrades a dependency, run a CVE scan (e.g., `pip-audit`, `npm audit`, `trivy`); block merge if high-severity findings are unresolved. 20. **Audit logging on sensitive actions.** Always emit a structured audit log entry (actor, action, resource ID, timestamp, outcome) for every privileged or destructive operation; never skip audit logging for admin endpoints.

---

See also

• `skills/code-quality/SKILL.md` — rules 20–23 cover sanitization, parameterized queries, and secret hygiene at a general level; this skill deepens those with IDOR, SSRF, and session specifics.
• `skills/error-log/SKILL.md` — ERR-2026-019 motivated rule 2 (resource ownership check).

---