Overview

The Security Review analyzes code changes to identify vulnerabilities across OWASP categories, injection vectors, authentication/authorization flaws, data exposure, and dependency risks. It classifies findings by severity and provides actionable remediation guidance to prevent security regressions before merge.

How This Skill Works

The review identifies modified files with security relevance, scans for common vulnerability patterns, and assesses changes to authentication and authorization logic. Findings are annotated with file paths and line numbers, severities, and remediation steps, aligned to OWASP references.

When to Use It

• After code review passes (or in parallel)
• Before any code merge involving user-facing changes
• As part of the /review-security command
• Mandatory for high-stakes implementations
• During CI gates or PR checks to enforce security before merge

Quick Start

1. Step 1: Identify modified files with security relevance
2. Step 2: Run the babysitter rpikit-review tool: methodologies/rpikit/rpikit-review
3. Step 3: Review findings with file paths, line numbers, severity, and remediation; re-run until issues are resolved

Best Practices

• Identify modified files with security relevance
• Scan for common vulnerability patterns
• Assess authentication and authorization changes
• Check for data exposure risks
• Evaluate dependency security

Example Use Cases

• A PR changes input handling in a web API and introduces an injection risk due to unsafe query construction
• Authentication flow changes broaden access rights beyond intended scopes
• API responses leak sensitive fields without proper redaction or filtering
• Updated dependencies introduce a known vulnerability in a transitive package
• Logging or error messages expose tokens or credentials

Frequently Asked Questions