Code Security Review

Lifecycle skill for REST and GraphQL APIs: covers secure design (controls to implement) and active security testing (payloads to validate those controls). One skill, two complementary modes — invoke whichever fits the current phase of work.

When to Use

Use this skill when:

• Designing or hardening FastAPI / Django / Flask APIs (→ references/python/), Gin / Fiber APIs (→ references/golang/), or Elysia APIs (→ references/DESIGN_CONTROLS.md)
• Reviewing an existing API for security weaknesses against the OWASP Web Top 10 (2025) + API Top 10 (2023)
• Pre-release security assessment before deploying to production (→ references/TESTING_PHASES.md)
• Bug bounty engagements or pentest of an API target
• Implementing or auditing AuthN/AuthZ (JWT, OAuth 2.1, DPoP, API keys, RBAC/ABAC)
• Adding rate limiting, input validation, CORS, or security headers
• Reporting findings — use the standardized template in references/REPORT_TEMPLATE.md
• Consulting the catalog of 100 web vulnerabilities by category (→ references/WEB_VULNERABILITIES.md)
• Auditing CI/CD + software supply chain (GitHub Actions, lockfile pinning, secrets, SBOM) — A03:2025 (→ references/SUPPLY_CHAIN_CICD.md)
• Reviewing LLM / agentic / MCP features (prompt injection, tool misuse, AI-generated-code patterns) — OWASP LLM 2025 + Agentic 2026 (→ references/AI_SECURITY.md)

This skill is fully standalone — every payload, snippet, and checklist needed lives in this directory.

How This Skill Is Organized

Phase 0 — Stack Detection

Detect the language/framework before loading stack-specific references. Steps 1–4 pick one $STACK (stop at the first match). Step 5 runs always and adds orthogonal surface overlays — AI and CI are independent of the stack.

# Step 1 — Go (Gin / Fiber)
test -f go.mod && grep -E 'gin-gonic/gin|gofiber/fiber/v[23]' go.mod && echo "stack: go"

# Step 2 — Next.js 16+ App Router
test -f package.json && rg '"next":\s*"\^?1[6-9]' package.json && test -d app/ && echo "stack: nextjs-app"

# Step 3 — Python (FastAPI / Django / Flask)
if test -f pyproject.toml || test -f requirements.txt || test -f setup.py; then
    rg -q '\bfastapi\b' pyproject.toml requirements*.txt 2>/dev/null && echo "stack: python (framework: fastapi)"
    rg -q '\bdjango\b'  pyproject.toml requirements*.txt 2>/dev/null && echo "stack: python (framework: django)"
    rg -q '\bflask\b'   pyproject.toml requirements*.txt 2>/dev/null && echo "stack: python (framework: flask)"
fi

# Step 4 — Elysia / generic
test -f bun.lockb && rg 'elysia' package.json && echo "stack: elysia"

# Step 5 — Surface overlays (always run, additive — not exclusive with the stack above)
rg -lq 'openai|@anthropic-ai/sdk|anthropic|langchain|llamaindex|litellm|ai-sdk|mcp' \
    package.json pyproject.toml requirements*.txt go.mod 2>/dev/null && echo "surface: ai-llm"
ls .mcp.json .cursor/mcp.json 2>/dev/null && echo "surface: mcp"
ls .github/workflows/*.y*ml 2>/dev/null && echo "surface: ci-cd"

The generic references (DESIGN_CONTROLS.md, TESTING_PHASES.md, WEB_VULNERABILITIES.md, REPORT_TEMPLATE.md) apply to every stack — load them in addition to the stack-specific bundle. Stack-specific references inherit the OWASP map and severity rubric from the generic ones; do not duplicate.

Step 5 overlays are additive and combine with any $STACK:

Security Foundations (Core Principles)

These principles are language and framework agnostic:

OWASP Top 10:2025 (Web)

The current Web list (final 2025 edition; replaces 2021). Use these tags for web findings; the API list below is a separate, still-current catalog.

Changes from 2021

• New: A03 Software Supply Chain Failures broadens the old "Vulnerable & Outdated Components" to the whole dependency→artifact path (see references/SUPPLY_CHAIN_CICD.md).
• New: A10 Mishandling of Exceptional Conditions — error-handling and fail-open logic become a first-class category.
• SSRF merged into A01 Broken Access Control (was its own A10 in 2021).
• Security Misconfiguration rose to #2. Several categories renamed (Auth Failures, Logging & Alerting Failures).

The OWASP API Top 10 below is a distinct list; its current edition is still 2023 (no 2025 API release).

OWASP API Security Top 10 (2023)

This is the 2023 list — the 2019 list is obsolete.

Changes from 2019

• Removed as separate items: "Excessive Data Exposure" and "Mass Assignment" — merged into API3 (Broken Object Property Level Authorization)
• Renamed: "Lack of Resources and Rate Limiting" → API4 "Unrestricted Resource Consumption"
• Added: API7 SSRF and API10 Unsafe Consumption of APIs

AI / LLM & Agentic Surface

When Phase 0 Step 5 flags ai-llm, mcp, or the code drives LLMs / agents, the web+API catalogs are necessary but not sufficient. Three additional catalogs apply:

• OWASP Top 10 for LLM Applications 2025 (LLM01:2025 Prompt Injection … LLM10:2025 Unbounded Consumption) — for any LLM-integrated app.
• OWASP Top 10 for Agentic Applications 2026 (ASI01:2026 Agent Goal Hijack … ASI10:2026 Rogue Agents) — for code that acts via tools, runs multi-step, or talks to other agents.
• OWASP GenAI MCP guides (Secure MCP Server Development; Securely Using Third-Party MCP Servers) — for projects wiring Model Context Protocol servers.

Full tables, controls, AI-generated-code review checklist, and testing payloads in references/AI_SECURITY.md. Static + gated active probes in scripts/11-ai-llm-probes.sh.

OWASP → Phase Map

Quick Audit Cheat Sheet

Run these checks before deploying any API:

• Auth required: every non-public endpoint returns 401 without a valid token
• Authorization checked: resource ownership verified before returning or modifying data (BOLA)
• CORS explicit: no allow_origins=["*"] + allow_credentials=True combination
• Input validated: all request bodies/params validated against a schema with strict types
• Parameterized queries: no string concatenation in SQL/database calls
• Rate limiting active: auth endpoints ≤ 5 req/15 min; general API ≤ 100 req/min
• Error messages generic: no stack traces or internal details in 4xx/5xx responses
• Security headers present: HSTS, X-Content-Type-Options, X-Frame-Options, CSP
• Dependencies audited: pip-audit / govulncheck / bun audit / osv-scanner passing in CI; lockfiles committed (A03:2025)
• No debug mode in production: FastAPI app = FastAPI(docs_url=None), Gin gin.SetMode(gin.ReleaseMode), Fiber app := fiber.New()
• CI/CD hardened: GitHub Actions pinned by 40-hex SHA (not tags); no pull_request_target + PR-head checkout; zizmor clean
• No committed secrets: gitleaks / trufflehog clean over tree + history
• AI/LLM surface safe: system prompt isolated from user input; LLM output encoded before any sink; MCP servers version-pinned

Framework-Specific Production Flags

For detailed implementation patterns per framework, see references/DESIGN_CONTROLS.md. For active probes that exercise these flags, see references/TESTING_PHASES.md.

Workflow Recommendations

Greenfield API

1. Read references/DESIGN_CONTROLS.md end-to-end before writing the first endpoint.
2. Pick framework section; copy auth/validation/rate-limit/CORS scaffolds.
3. After MVP is functional, run references/TESTING_PHASES.md Phase 1–7 against staging.
4. File findings using references/REPORT_TEMPLATE.md.

Existing API (audit / pre-release)

1. Run references/TESTING_PHASES.md Phase 1–7 against the target.
2. For each finding, cross-reference the corresponding section in references/DESIGN_CONTROLS.md to identify the missing or misconfigured control.
3. Apply fix → re-run the specific phase to validate.
4. File using references/REPORT_TEMPLATE.md.

Bug Bounty / Pentest

1. Pre-Testing Checklist in references/TESTING_PHASES.md — confirm scope and authorization.
2. Run all 7 phases; document each finding with references/REPORT_TEMPLATE.md.
3. Severity rubric (CVSS bands) in the same file.

Automated Probes (CI / Pre-Release)

Use scripts/ for hands-off execution:

cd skills/code-security-review/scripts/
export TARGET="https://api.staging.example.com"
export TOKEN_USER_A="..." TOKEN_USER_B="..." USER_A_RESOURCE_ID="42"
export ORIGIN_ALLOWED="https://app.example.com"
export I_HAVE_AUTHORIZATION=1
./run-all.sh                                    # active phases 00–08 + static 09–11

# Static-only — no live target, no authorization needed (deps, CI, secrets, AI):
STATIC_ONLY=1 PROJECT_ROOT=. ./run-all.sh

Each phase from TESTING_PHASES.md has a script counterpart that emits findings as JSON-Lines (out/findings.jsonl) plus an aggregated Markdown report (out/report.md). Active phases (00–08) need an authorized TARGET; static phases (07 supply chain, 09 CI/CD, 10 secrets, 11 AI/LLM) read repository files and run without a target. The active prompt-injection battery in 11 stays gated by LLM_ENDPOINT + I_HAVE_AUTHORIZATION=1. Designed to gate CI on critical/high findings. See scripts/README.md for env vars and CI integration example.

Related Skills

• @code-review — broader code-quality review that pairs with this skill for security-specific concerns. For Next.js performance audits, see @code-review references/NEXTJS.md.

For a formal verification standard, deep audits can map findings to OWASP ASVS 5.0 (17 chapters, levels 1–3); use it to set a coverage bar beyond the Top 10.