security-review

Use this checklist when reviewing code for security concerns.

Security Review Checklist

Use this checklist when reviewing code for security concerns. All items should be verified before approving security-sensitive changes.

Authentication & Authorization

Authentication

[ ] All endpoints require authentication where appropriate
[ ] Authentication tokens are validated on every request
[ ] Token expiration is enforced
[ ] Refresh tokens are implemented securely
[ ] Session invalidation works correctly (logout, password change)
[ ] Multi-factor authentication (MFA) is supported where required
[ ] Failed login attempts are rate-limited
[ ] Account lockout after repeated failed attempts
[ ] Passwords are never logged or stored in plain text
[ ] Password reset flow is secure (no user enumeration, expiring tokens)

Authorization

[ ] Authorization checks happen on every privileged operation
[ ] Role-based access control (RBAC) is enforced
[ ] Principle of least privilege is followed
[ ] Users can only access their own data (no IDOR vulnerabilities)
[ ] Object-level authorization is checked (not just endpoint-level)
[ ] Privilege escalation is not possible
[ ] JWT claims are validated (issuer, audience, expiration)
[ ] API keys have appropriate scopes/permissions
[ ] Service-to-service authentication is implemented
[ ] Authorization decisions are centralized (not scattered)

Input Validation

General Validation

[ ] All user input is validated (type, length, format)
[ ] Validation happens on server-side (not just client-side)
[ ] Whitelist validation is preferred over blacklist
[ ] Error messages don't leak sensitive information
[ ] File uploads are restricted (type, size, content)
[ ] File names are sanitized (no path traversal)
[ ] Uploaded files are scanned for malware
[ ] Integer overflow/underflow is prevented
[ ] Unicode/encoding issues are handled

SQL Injection Prevention

[ ] SQL queries use parameterized statements or ORM
[ ] No string concatenation for SQL queries
[ ] Dynamic SQL is avoided or properly escaped
[ ] Stored procedures use parameters correctly
[ ] Database permissions follow least privilege

XSS Prevention

[ ] All user input is escaped before rendering in HTML
[ ] Content Security Policy (CSP) headers are set
[ ] HTML sanitization library used for rich text
[ ] JSON responses have correct Content-Type header
[ ] DOM manipulation is safe (no innerHTML with user data)
[ ] Template engine auto-escapes by default

Command Injection Prevention

[ ] System commands avoid shell=True
[ ] User input is not passed to shell commands
[ ] Commands use array syntax (not string concatenation)
[ ] subprocess.run() uses list instead of string
[ ] Environment variables are not user-controlled

Path Traversal Prevention

[ ] File paths are validated (no ../ sequences)
[ ] Absolute paths are used internally
[ ] File access is restricted to specific directories
[ ] Symlinks are resolved and validated
[ ] Chroot/sandbox is used where appropriate

Data Protection

Encryption at Rest

[ ] Sensitive data is encrypted in database
[ ] Encryption keys are stored securely (not in code)
[ ] Strong encryption algorithms used (AES-256, RSA-2048+)
[ ] Encryption keys are rotated periodically
[ ] Backups are encrypted
[ ] Database field-level encryption for PII
[ ] Full-disk encryption for storage volumes

Encryption in Transit

[ ] All network traffic uses TLS/HTTPS
[ ] TLS 1.2+ is required (1.0/1.1 disabled)
[ ] Strong cipher suites configured
[ ] Certificate validation is enforced
[ ] Certificate pinning for mobile apps
[ ] Internal service-to-service communication is encrypted
[ ] WebSocket connections use WSS

Secrets Management

[ ] No secrets hardcoded in source code
[ ] No secrets in configuration files committed to git
[ ] Environment variables used for secrets
[ ] Secrets manager used (AWS Secrets Manager, external secret manager)
[ ] API keys rotated regularly
[ ] Database passwords rotated regularly
[ ] Secrets are not logged
[ ] Secrets are not sent to error tracking services

PII/Sensitive Data

[ ] PII is identified and classified
[ ] Data minimization principle followed (collect only what's needed)
[ ] PII retention policy implemented
[ ] Data deletion capability exists (GDPR right to erasure)
[ ] Data export capability exists (GDPR right to portability)
[ ] Consent management implemented
[ ] Anonymization/pseudonymization used where appropriate
[ ] PII access is logged and audited

Common Vulnerabilities

Injection Attacks

[ ] No SQL injection vulnerabilities
[ ] No command injection vulnerabilities
[ ] No LDAP injection vulnerabilities
[ ] No XML/XPath injection vulnerabilities
[ ] No template injection vulnerabilities
[ ] No NoSQL injection vulnerabilities

Cross-Site Attacks

[ ] No Cross-Site Scripting (XSS) vulnerabilities
[ ] No Cross-Site Request Forgery (CSRF) vulnerabilities
[ ] CSRF tokens implemented for state-changing operations
[ ] SameSite cookie attribute set appropriately
[ ] Origin validation for CORS
[ ] No clickjacking vulnerabilities (X-Frame-Options header)

Insecure Deserialization

[ ] Deserialization only from trusted sources
[ ] Type validation before deserialization
[ ] Avoid pickle (Python), ObjectInputStream (Java) with user data
[ ] Use safe serialization formats (JSON, protobuf)
[ ] Signature verification for serialized data

XXE (XML External Entity)

[ ] XML parsing disables external entities
[ ] XML parsing disables DTD processing
[ ] Safe XML parsers configured correctly
[ ] Avoid XML where JSON suffices

Open Redirect

[ ] Redirect URLs are validated
[ ] Whitelist of allowed redirect destinations
[ ] No user-controlled redirect parameters
[ ] Referrer header checked for sensitive redirects

Server-Side Request Forgery (SSRF)

[ ] User-provided URLs are validated
[ ] Whitelist of allowed protocols/hosts
[ ] Internal IP ranges blocked (127.0.0.1, 169.254.x.x, etc.)
[ ] DNS rebinding protection
[ ] Timeout for external requests

Dependencies & Supply Chain

Dependency Management

[ ] All dependencies are up-to-date
[ ] No known vulnerabilities (npm audit, pip-audit, cargo audit)
[ ] Dependency versions are pinned
[ ] Transitive dependencies reviewed
[ ] Dependencies have active maintenance
[ ] Licenses are compatible with project
[ ] Private package registry used for internal packages
[ ] Dependency confusion attacks prevented

Container Security

[ ] Base images are minimal and up-to-date
[ ] Containers run as non-root user
[ ] Container images scanned for vulnerabilities (Trivy, Snyk)
[ ] Multi-stage builds used to minimize image size
[ ] Secrets not baked into images
[ ] Container registry is private and secured

Configuration & Deployment

Security Headers

[ ] Content-Security-Policy header set
[ ] X-Frame-Options header set (DENY or SAMEORIGIN)
[ ] X-Content-Type-Options: nosniff header set
[ ] Strict-Transport-Security header set (HSTS)
[ ] Referrer-Policy header set appropriately
[ ] Permissions-Policy header set
[ ] X-XSS-Protection header set (legacy browsers)

CORS Configuration

[ ] CORS is not wildcard (*) in production
[ ] Allowed origins are whitelisted
[ ] Credentials are handled securely
[ ] Preflight requests handled correctly

Error Handling

[ ] Stack traces not exposed to users
[ ] Error messages don't leak system information
[ ] Generic error messages for authentication failures
[ ] Detailed errors logged server-side only
[ ] 404 vs 403 used appropriately (no information disclosure)

Logging & Monitoring

[ ] Security events are logged (login, logout, access denied)
[ ] Logs don't contain sensitive information (passwords, tokens, PII)
[ ] Logs are centralized and monitored
[ ] Anomaly detection configured
[ ] Alerting configured for security events
[ ] Log retention policy defined

Rate Limiting & DoS Protection

Rate Limiting

[ ] API endpoints have rate limits
[ ] Login endpoints have stricter rate limits
[ ] Rate limits are per-user and per-IP
[ ] Rate limit headers returned (X-RateLimit-*)
[ ] Rate limiting uses token bucket or leaky bucket algorithm
[ ] Redis or similar for distributed rate limiting

DoS Protection

[ ] Request size limits enforced
[ ] Request timeout configured
[ ] Connection limits configured
[ ] Expensive operations are async or queued
[ ] CDN/WAF used for DDoS protection
[ ] Circuit breaker pattern for external dependencies

Mobile & API Specific

Mobile Apps

[ ] Certificate pinning implemented
[ ] Secrets not stored in app binary
[ ] Local data encrypted (Keychain, KeyStore)
[ ] Jailbreak/root detection considered
[ ] Code obfuscation used
[ ] App transport security configured

API Security

[ ] API versioning implemented
[ ] API documentation accurate and complete
[ ] Deprecated endpoints removed or disabled
[ ] API keys have expiration
[ ] Webhook signatures verified
[ ] GraphQL query depth limited
[ ] GraphQL introspection disabled in production

Compliance & Privacy

GDPR (if applicable)

[ ] Data processing legal basis documented
[ ] Consent management implemented
[ ] Right to access implemented
[ ] Right to erasure implemented
[ ] Right to portability implemented
[ ] Data breach notification process defined
[ ] Privacy policy accurate and accessible

PCI-DSS (if handling payment cards)

[ ] Credit card data not stored (use tokenization)
[ ] PCI-compliant payment processor used
[ ] Cardholder data environment (CDE) segmented
[ ] Strong cryptography used
[ ] Access to cardholder data logged

HIPAA (if handling health data)

[ ] PHI identified and protected
[ ] Encryption at rest and in transit
[ ] Access controls implemented
[ ] Audit logging enabled
[ ] Business associate agreements in place

Incident Response

Preparedness

[ ] Security incident response plan exists
[ ] Incident response team identified
[ ] Escalation procedures documented
[ ] Contact information up-to-date
[ ] Runbooks for common security scenarios

Detection

[ ] Security monitoring configured
[ ] Intrusion detection system (IDS) in place
[ ] Log aggregation and analysis
[ ] Alerting on suspicious activity
[ ] Regular security audits scheduled

Response

[ ] Ability to disable compromised accounts
[ ] Ability to rotate secrets quickly
[ ] Ability to rollback deployments
[ ] Backup and recovery tested
[ ] Communication plan for security incidents

Critical Security Checklist (Quick Reference)

Use this abbreviated checklist for fast security verification:

[ ] Authentication on all protected endpoints
[ ] Authorization checked for every privileged action
[ ] All input validated (SQL, XSS, command injection)
[ ] Secrets not in code (use environment variables)
[ ] HTTPS everywhere (TLS 1.2+)
[ ] CSRF protection on state-changing operations
[ ] No sensitive data in logs
[ ] Dependencies have no known vulnerabilities
[ ] Rate limiting on public endpoints
[ ] Security headers configured

Severity Assessment

CRITICAL (Block Merge):

SQL injection, XSS, command injection vulnerabilities
Authentication bypass
Hardcoded secrets
No authorization checks on sensitive operations
Insecure deserialization of user data

HIGH (Fix Before Merge):

Missing CSRF protection
Weak encryption (MD5, SHA1, DES)
PII not encrypted at rest
No rate limiting on authentication
Known high-severity CVEs in dependencies

MEDIUM (Fix Soon):

Missing security headers
Verbose error messages
No input validation on non-critical fields
Missing audit logging
Known medium-severity CVEs

LOW (Nice to Have):

Missing documentation
Non-optimal configuration
Known low-severity CVEs
Code quality issues affecting security indirectly

Reviewer: _____________ Date: _____________ Result: ⚪ Pass / 🔴 Fail / 🟡 Conditional Pass