Security Reviewer

Security Reviewer is a community skill for conducting security-focused code reviews, covering threat modeling, vulnerability assessment, authentication review, authorization validation, and data protection analysis for application security assurance.

What Is This?

Overview

Security Reviewer provides a structured approach to evaluating application code for security weaknesses. It covers threat modeling that identifies attack surfaces and potential threat actors targeting the application, vulnerability assessment that examines code for weakness patterns from OWASP and CWE databases, authentication review that validates login flows and credential handling, authorization validation that checks access control logic for privilege escalation, and data protection analysis that verifies encryption and sanitization of sensitive information. The skill helps teams identify security issues before deployment.

Who Should Use This

This skill serves security engineers performing code audits, developers building authentication and authorization systems, and team leads responsible for ensuring application security standards are met.

Why Use It?

Problems It Solves

Security vulnerabilities in production code lead to data breaches and compliance failures. Authentication implementations often contain subtle flaws in session management or token validation. Authorization logic errors can allow users to access resources beyond their permissions. Sensitive data may be logged or transmitted without adequate protection.

Core Highlights

Threat modeler maps attack surfaces and identifies risk areas. Vulnerability assessor checks code against OWASP weakness patterns. Auth reviewer validates login flows and session handling. Data protector verifies encryption and sanitization of sensitive fields.

How to Use It?

Basic Usage

import ast
import re
from pathlib import Path

class SecurityReview:
  def __init__(
    self, root: str
  ):
    self.root = Path(root)
    self.findings = []

  def check_auth(
    self, filepath: str
  ):
    code = Path(
      filepath
    ).read_text()
    if ('password' in code
      and 'hash' not in
        code.lower()):
      self.findings.append(
        {'file': filepath,
         'issue': 'Password '
           'without hashing',
         'severity':
           'critical'})
    if re.search(
      r'jwt\.decode\([^)]*'
      r'verify\s*=\s*'
      r'False', code
    ):
      self.findings.append(
        {'file': filepath,
         'issue': 'JWT '
           'verification '
           'disabled',
         'severity':
           'critical'})

  def check_injection(
    self, filepath: str
  ):
    code = Path(
      filepath
    ).read_text()
    patterns = [
      (r'execute\(\s*f["\']',
       'SQL injection'),
      (r'subprocess.*shell'
       r'\s*=\s*True',
       'Command injection'),
      (r'eval\s*\(',
       'Code injection')]
    for pat, label in (
      patterns
    ):
      if re.search(
        pat, code
      ):
        self.findings\
          .append({
            'file': filepath,
            'issue': label,
            'severity':
              'high'})

  def report(self) -> str:
    lines = []
    for f in self.findings:
      lines.append(
        f'{f["severity"]}: '
        f'{f["issue"]} in '
        f'{f["file"]}')
    return '\n'.join(lines)

review = SecurityReview('.')
review.check_auth(
  'auth.py')
review.check_injection(
  'db.py')
print(review.report())

Real-World Examples

from dataclasses import (
  dataclass, field)

@dataclass
class AuthzFinding:
  endpoint: str
  issue: str
  risk: str

class AuthzReviewer:
  def __init__(self):
    self.findings: list[
      AuthzFinding] = []

  def check_endpoint(
    self,
    endpoint: str,
    has_auth: bool,
    has_rbac: bool,
    sensitive: bool
  ):
    if not has_auth:
      self.findings.append(
        AuthzFinding(
          endpoint,
          'No authentication',
          'critical'
            if sensitive
            else 'high'))
    if has_auth and (
      not has_rbac
    ):
      self.findings.append(
        AuthzFinding(
          endpoint,
          'Missing role '
          'check',
          'high'
            if sensitive
            else 'medium'))

  def summary(self) -> dict:
    return {
      'total':
        len(self.findings),
      'critical': sum(
        1 for f in
        self.findings
        if f.risk ==
          'critical'),
      'findings': [
        {'ep': f.endpoint,
         'issue': f.issue}
        for f in
        self.findings]}

reviewer = AuthzReviewer()
endpoints = [
  ('/api/users',
   True, True, True),
  ('/api/admin',
   True, False, True),
  ('/api/public',
   False, False, False)]
for ep, auth, rbac, sens\
  in endpoints:
  reviewer.check_endpoint(
    ep, auth, rbac, sens)
result = reviewer.summary()
print(
  f'{result["total"]} '
  f'issues found')

Advanced Tips

Create a threat model diagram before reviewing code to focus attention on the highest-risk components. Review authentication code separately from business logic to maintain focus on security concerns. Test authorization by tracing request paths from entry point to data access.

When to Use It?

Use Cases

Audit authentication flows for session fixation and token handling vulnerabilities before release. Review API endpoints for missing authorization checks that could allow unauthorized data access. Assess data handling code for proper encryption and sanitization of personally identifiable information.

Related Topics

Application security, code review, threat modeling, OWASP, authentication, authorization, and penetration testing.

Important Notes

Requirements

Access to application source code including authentication and authorization modules. Understanding of OWASP Top 10 vulnerability categories and common weakness enumeration patterns. Knowledge of the application architecture and data flow for effective threat modeling.

Usage Recommendations

Do: review security-critical code paths with dedicated focus separate from functional code reviews. Validate that all API endpoints enforce appropriate authentication and authorization. Check that sensitive data is encrypted at rest and in transit throughout the application.

Don't: assume that framework defaults provide sufficient security without verifying the configuration. Skip reviewing error handling since stack traces can leak sensitive information. Rely solely on automated tools since manual review is needed for logic-level security flaws.

Limitations

Manual security review cannot scale to cover every line in large codebases and must prioritize high-risk areas. Review findings reflect a point-in-time assessment and may miss vulnerabilities from later changes. Security reviews cannot guarantee absence of vulnerabilities since new attack techniques continually emerge.