code-check-security-regression

What problem does it solve?

This Skill helps teams detect newly introduced application-security vulnerabilities that appear during fast iteration, such as secret leaks, unsafe webhook handling, SSRF, insecure file handling, XSS, unsafe redirects, and missing rate limits.

Core Features & Use Cases

• Secret exposure regression checks: Verifies whether secret-like environment variables are logged or accidentally reach client bundles.
• Webhook signature verification validation: Flags webhook handlers that process requests without verifying authenticity.
• SSRF and unsafe fetch validation: Detects fetch/HTTP calls that may use user-controlled URLs without allowlisting.
• Upload/download safety review: Looks for unsafe handling in upload/download paths, including traversal and missing constraints.
• Dangerous rendering detection: Finds risky rendering patterns like dangerouslySetInnerHTML and unsafe innerHTML usage tied to user content.
• Redirect and security header hygiene: Identifies open-redirect patterns and missing rel="noopener noreferrer" on target="_blank".
• Abuse-prone endpoint rate limiting checks: Flags new public endpoints that may need rate limiting.

Quick Start

Run a Git diff–scoped security regression scan and review the ranked HIGH/MEDIUM/LOW findings, applying only the allowed mechanical auto-fixes.