security-review

To check application code for security vulnerabilities, review authentication, authorization, input validation, and secrets management. Ensure API keys use environment variables, queries are parameterized, and rate limiting plus safe error logging are enforced across API workflows.

API hardening protects sensitive data operations by enforcing authentication, authorization, rate limiting, CSRF protection, and XSS defenses. It requires secure token storage, input sanitization, and safe logging patterns to prevent unauthorized access and data exposure.

To prevent hardcoded API keys and tokens in source files, implement secrets management practices that source credentials from environment variables. Verify that passwords and tokens are never stored directly in code to reduce unauthorized access risks.

To validate user input and file uploads and reduce injection risks, enforce strict schema checks and upload constraints. Apply input sanitization and parameterized queries to handle malformed input and prevent malicious payload execution.

Automated security review applies to payment features and external integrations by validating permissions, enforcing secure token storage, and checking safe error handling. It confirms routes validate inputs and protect credentials before code reaches production.

Automated vulnerability assessment for API workflows requires manual confirmation of contextual authorization logic and business rule enforcement. It identifies missing rate limiting and sanitization but cannot verify complex permission hierarchies dynamically.