What problem does it solve? Security-critical code changes often ship without systematic review, leaving vulnerabilities like SQL injection, authentication bypass, and leaked secrets undetected until production. This Skill provides a structured checklist-driven review process so nothing security-relevant is overlooked. ## Core Features & Use Cases - Ten-Domain Security Checklist: Covers authentication, MFA, sensitive data handling, input validation, database security, API security, cryptography, file uploads, session management, and dependency vulnerabilities. - Detailed Reference Guides: Each checklist section links to an in-depth guide in references/ with concrete bad/good Go and React code patterns, such as bcrypt password hashing, parameterized GORM queries, and secure CORS configuration. - Tooling Integration: Includes commands for running gosec, govulncheck, and yarn audit to catch issues automatically. - Use Case: When modifying a login endpoint that adds MFA, invoke this Skill to verify TOTP secret encryption, rate limiting on verification attempts, and backup code generation before merging. ## Quick Start Review my changes to the authentication and MFA endpoints using the security review checklist and flag any vulnerabilities.
