crypto

To review code for cryptography anti-patterns, target risky constructs in authentication and encryption modules like weak RNG, IV reuse, and unauthenticated encryption. Apply evidence-driven detection signals to map issues to concrete remediation guidance for fixes.

Common JWT verification weaknesses include algorithm confusion, missing kid validation, and skipped claim checks. Reviewing these token signing and verifying routines ensures strict alg/kid/claim validation to prevent signature verification bypasses and token forgery.

Fix password hashing parameter errors by enforcing RFC-compliant practices for bcrypt and Argon2 configurations. Review parameter values in hashing routines to ensure they meet current security standards for strong password storage and resistance to brute-force attacks.

Prevent secret leakage by enforcing redaction of sensitive material in logging statements within encryption, decryption, and API webhook validation modules. Review log outputs to ensure cryptographic keys and tokens are never exposed in plaintext.

Yes, this crypto review covers insecure TLS settings and AES-GCM misuse by detecting disabled TLS verification and unauthenticated encryption. It maps these detection signals to prioritized fixes across AES-GCM/CBC modes and TLS verification requirements.

Constant-time comparisons are needed whenever signature validation or API webhook verification occurs to prevent timing attacks. Enforce constant-time comparison requirements in security code review to protect against signature verification bypasses.