security-review-owasp-choosing-and-using-security-questions

What problem does it solve?

This Skill helps security reviewers evaluate security-question flows for weaknesses that can lead to account takeover, identity confusion, or privilege escalation.

Core Features & Use Cases

• Reviews enrollment, recovery, reset, and step-up paths for weak identity proof and fallback bypasses.
• Traces identity and authorization context across services, headers, background jobs, and delegated actions.
• Flags missing rate limits, notifications, audit trails, and safe failure handling in high-risk account flows.
• Use it to assess a login recovery design, a self-service profile change flow, or a service-to-service trust boundary that relies on user identity claims.

Quick Start

Use this skill to review the attached security-question recovery flow and report any confirmed account takeover or trust-propagation weaknesses.