node-security-review

Start with the auth boundary to confirm tokens are verified rather than decoded, then check route input validation, cookie and CORS posture, outbound URL handling, and error or logging exposure. This Skill follows that inspection order and reports only findings with a concrete exploit path.

Check whether user-influenced URLs are parsed with new URL() and restricted to safe schemes, whether redirects are re-validated per hop, and whether DNS or private IP checks block internal destinations. Regex-only URL checks with followed redirects are a classic SSRF finding.

Fail-open behavior occurs when a verification error, missing secret, or timeout causes the system to allow access or downgrade to guest instead of denying the request. Examples include catching JWT verification errors and continuing, or starting the server with a fallback dev secret.

No, the review is scoped to application-layer security boundaries like verification, secret handling, and exposure paths. Product authorization policy, fraud rules, and generic rate limiting are explicitly handed off to other concerns unless they involve a real security bypass.

jwt.decode only parses the token payload without checking the signature, so an attacker can forge arbitrary claims like an admin role. Any code that trusts decoded claims before successful verification has a broken identity-proof guarantee.