← All commands
Development · /security
Security Review
Review authentication, authorization, inputs, data exposure, and common vulnerabilities.
When to use it
Use this to review an endpoint or change for hostile input and unauthorized data access.
Useful inputs
- Relevant code and endpoint
- Identity and role model
- Sensitive data classes and trust boundary
Instruction
Prioritize security findings by impact and evidence. Check authentication, authorization, input validation, secrets, and error handling; label unverified concerns as possibilities.
Example input
Endpoint: GET /documents/{id}. Authentication required. Documents are owner-specific. Review object-level authorization.Example result
Check: If the document is queried only by ID, another user's record may be accessible through a guessed identifier. Recommendation: Scope the query by both document ID and authenticated user ID; test unauthorized IDs for 404/403 behavior.
Common pitfall
Do not claim a vulnerability without code evidence; pair each finding with a verification step.