Security & Auditing Skills

Reviews API and infrastructure security configuration, including endpoints, headers, transport, and deployment settings. Use when auditing API or infrastructure hardening.

Conducts a comprehensive authentication security review covering login, sessions, tokens, and credential handling. Use when auditing authentication for vulnerabilities.

Analyzes authorization and access-control logic across routes and resources for privilege and enforcement flaws. Use when auditing authorization, RBAC, or access control.

Analyzes business logic for security flaws such as workflow bypasses, race conditions, and abuse cases. Use when reviewing application logic for exploitable behavior.

Detects duplicated and near-duplicate code across the codebase and suggests consolidation. Use when reviewing for copy-paste code, repeated logic, or DRY violations.

Analyzes code complexity and adherence to quality standards, flagging overly complex functions and metric outliers. Use when auditing maintainability, cyclomatic complexity, or coding-standard compliance.

Aggregates findings from the other security audits into one prioritized security report. Use after running individual security reviews to produce a consolidated report.

Examines all database interactions for injection, access control, encryption, and data-exposure risks. Use when auditing database and data-layer security.

Reviews how design patterns are used or misused across the codebase and where patterns would help. Use when evaluating architecture, pattern fit, or over-engineering.

Performs a comprehensive error-handling review across the codebase, checking coverage, propagation, and recovery. Use when auditing how the system handles and recovers from failures.

Traces how errors and exceptions flow through critical code paths to find swallowed errors and broken propagation. Use when analyzing exception handling on important paths.

Reviews file upload and handling for path traversal, type validation, storage, and related logic flaws. Use when auditing file upload or processing security.

Performs a first-pass security audit of project structure and attack surface to map risk and entry points. Use as the starting point for a security review.

Produces a first-pass architecture and design review covering structure, maintainability, and scalability. Use when onboarding to or assessing the design of a codebase.

Use when working with logging or monitoring — Sentry error tracking, Grafana/Loki log aggregation, structured logging channels, or monitoring helpers.

Reviews readability, naming conventions, and clarity, flagging confusing identifiers and structure. Use when auditing for readability, naming consistency, or style.

Evaluates resilience and fault tolerance, including failure modes, retries, timeouts, and graceful degradation. Use when reviewing reliability under failure conditions.

Scans the codebase for hardcoded secrets and weak secret handling, and checks rotation and key management. Use when auditing API keys, passwords, tokens, or secret storage.

Analyzes session and cookie security, including flags, expiration, fixation, and storage. Use when auditing session management and cookie configuration.

Evaluates test implementation and coverage, identifying gaps, weak assertions, and untested paths. Use when auditing test quality, coverage, or testing strategy.