GSD — Security Review

Automate a security review by running a structured OWASP and defense-in-depth checklist against security-touching files in your code changes. This generates a SECURITY.md gate with PASS/FAIL status, remediation steps, and evidence to justify release decisions.

Defense-in-depth in code security audits is enforcing multiple layers of OWASP best practices, such as input validation, parameterized queries, and output encoding. This Skill applies these checks to authentication, data persistence, and external API files to prevent shipping critical vulnerabilities.

Identify security-touching files by analyzing a REVIEW.md file or git diff for changes handling authentication, authorization, data persistence, external API calls, user input, file operations, and secrets management, then apply a structured security checklist to validate those specific changes.

Yes, you can gate your CI pipeline by generating a SECURITY.md file containing a PASS/FAIL gate. This audit artifact provides remediation guidance and evidence, allowing your pipeline to block releases that fail the structured OWASP defense-in-depth checklist.

Security checks performed on user input and database operations include validating input validation, parameterized queries, proper output encoding, and authentication checks. These are enforced through a structured checklist against OWASP best practices to prevent common vulnerabilities.

Yes, the security review works without external dependencies. It identifies security-touching files from local REVIEW.md files or git diffs and runs a self-contained structured checklist to produce a SECURITY.md gate with remediation guidance and audit evidence.