review-security

To review code diffs for security risks, examine authentication boundaries, secret exposure, and injection vulnerabilities. Apply a security-focused lens to changes in Express-based stacks, checking specifically for input sanitization and unsafe trust of external input.

A security code review for Express APIs is an analysis of proposed changes to enforce explicit checks for authentication, authorization, and secret handling. It identifies auth boundary gaps and injection risks in service boundaries to prevent data leakage and privilege escalation.

To check MongoDB changes for privilege escalation risks, evaluate data access patterns and service boundaries during the code review. Apply risk-focused guidance to Mongo access to ensure external integrations do not leak data or allow unauthorized privilege escalation.

Yes, this security review works with the tektonology-api. It is explicitly designed to evaluate proposed changes to the tektonology-api, ensuring no exposure of credentials or insecure API calls exist within the Express-based stack before push.

You need to run a security pass on your code when evaluating a proposed change to an API or service boundary. Apply this review whenever a skills-advisor recommends a security lens or before a push to verify safe error reporting and input validation.

The best way to prevent secret exposure in API code changes is to enforce explicit checks for secret handling during diff reviews. Scrutinize external integrations and service boundaries to ensure credentials are not exposed and unsafe trust of client input is eliminated.