What problem does it solve?
White-box PHP security reviews often miss subtle flaws like loose comparison bypasses, IDOR, debug mode leftovers, weak password hashing, and race conditions. This Skill provides a structured audit methodology covering five risk categories so reviewers can systematically detect authentication bypass, authorization failures, insecure configuration, cryptographic misuse, and business logic defects directly in source code.
Core Features & Use Cases
- Five-Category Risk Coverage: Audit checklists and dangerous-vs-safe code patterns for authentication bypass (hardcoded credentials,
== weak comparison, JWT flaws), authorization failures (IDOR, middleware gaps, horizontal/vertical privilege escalation), security configuration (php.ini baseline, CORS, debug mode), cryptographic misuse (md5/sha1 password storage, ECB mode, hardcoded keys, weak randomness), and business logic (race conditions, payment tampering, state machine skips).
- Detection Patterns & Grep Strategies: Ready-to-use search commands and code signatures for locating hardcoded secrets, weak comparisons, and unsafe random token generation.
- Use Case: During a code audit of a Laravel application, use this Skill to verify JWT signature validation, check route middleware coverage with
php artisan route:list, confirm password_hash usage, and inspect wallet balance updates for missing lockForUpdate transactions.
Quick Start
Audit this PHP codebase for authentication bypass, IDOR, insecure configuration, weak cryptography, and business logic flaws using the five-category checklist.
