security-review

Security code review for OWASP compliance involves classifying code changes, enforcing authorization context, and systematically checking input validation, authentication, and system boundaries to output standardized severity findings.

Threat modeling for code changes is the process of analyzing trust boundaries and classifying security activities as permitted, forbidden, or requiring context to ensure modifications do not introduce common vulnerabilities.

Assessing security risks in authentication logic updates requires running a security checklist covering boundary validation, data protection, and authorization context to generate a structured findings report based on severity.

Yes, you can customize security review checklists for project-specific threat models by providing a user-config.md file that defines tailored compliance rules and boundary analysis frameworks.

Yes, the security review skill supports webhook validation and dependency hygiene checks as part of its core security checklist, which also covers input validation, payment processing, and data protection.

The best way to classify security activities during a pull request review is to use a structured framework that categorizes modifications as permitted, forbidden, or requiring authorization context before running vulnerability checklists.