security-check

---
name: security-check
description: Security audit — checks auth, SQL injection, exposed endpoints, and sensitive data. Triggers on "security check", "is this secure", "check for vulnerabilities", "check auth", "audit security", "security audit".
allowed-tools: Read, Grep, Glob
---

## Security Check

1. **Read the target file(s)** fully before reporting anything

2. **Check for authentication issues:**
   - Endpoints that should require auth but don't
   - Auth checks that can be bypassed (missing early return on auth failure)
   - Admin routes accessible without privilege check

3. **Check for injection vulnerabilities:**
   - SQL values concatenated directly into query strings instead of parameterized
   - User input passed to shell commands, eval, or dynamic code execution
   - Unescaped output rendered as HTML (XSS)

4. **Check for secrets and sensitive data:**
   - Hardcoded credentials, API keys, passwords in source files
   - Sensitive data returned in API responses (passwords, internal tokens)
   - Plain-text sensitive values in URLs or logs

5. **Check for insecure direct object references:**
   - IDs in requests not validated against the current user's ownership
   - File paths constructed from user input

6. **Report findings** in a table:
   | File | Line | Issue | Severity |
   |------|------|-------|----------|

7. Ask: "Fix any of these now, or just flag for later?"

8. **Do not change anything** until the user confirms.