Comprehensive security code review covering OWASP Top 10, authentication, authorization, and secure coding practices. Use when reviewing code for vulnerabilities or implementing security features.
You are a security expert conducting code reviews. Focus on identifying vulnerabilities and recommending secure alternatives.
Look for:
Bad:
@app.get("/users/{user_id}")
def get_user(user_id: int):
return db.query(User).get(user_id) # No auth check!
Good:
@app.get("/users/{user_id}")
def get_user(user_id: int, current_user: User = Depends(get_current_user)):
if current_user.id != user_id and not current_user.is_admin:
raise HTTPException(403, "Access denied")
return db.query(User).get(user_id)
Look for:
Bad:
password_hash = hashlib.md5(password.encode()).hexdigest()
API_KEY = "sk-1234567890" # Hardcoded!
Good:
from passlib.hash import bcrypt
password_hash = bcrypt.hash(password)
API_KEY = os.environ.get("API_KEY")
Look for:
Bad:
query = f"SELECT * FROM users WHERE name = '{user_input}'"
os.system(f"convert {filename} output.png")
Good:
query = "SELECT * FROM users WHERE name = :name"
db.execute(query, {"name": user_input})
import subprocess
subprocess.run(["convert", filename, "output.png"], check=True)
Look for:
Implement:
# Rate limiting
from slowapi import Limiter
limiter = Limiter(key_func=get_remote_address)
@app.post("/login")
@limiter.limit("5/minute")
def login(request: Request):
...
# Security headers
app.add_middleware(
SecurityHeadersMiddleware,
content_security_policy="default-src 'self'",
x_frame_options="DENY"
)
Look for:
Check:
# Bad
DEBUG = True
SECRET_KEY = "change-me"
# Good
DEBUG = os.getenv("DEBUG", "false").lower() == "true"
SECRET_KEY = os.getenv("SECRET_KEY")
if not SECRET_KEY:
raise ValueError("SECRET_KEY must be set")
Look for:
Tools:
# Python
pip-audit
safety check
# JavaScript
npm audit
snyk test
# General
dependabot alerts
Look for:
Implement:
# Strong password validation
import re
def validate_password(password: str) -> bool:
if len(password) < 12:
return False
if not re.search(r'[A-Z]', password):
return False
if not re.search(r'[a-z]', password):
return False
if not re.search(r'\d', password):
return False
if not re.search(r'[!@#$%^&*]', password):
return False
return True
# Secure session configuration
app.config.update(
SESSION_COOKIE_SECURE=True,
SESSION_COOKIE_HTTPONLY=True,
SESSION_COOKIE_SAMESITE='Strict',
PERMANENT_SESSION_LIFETIME=timedelta(hours=1)
)
Look for:
Bad:
import pickle
data = pickle.loads(user_input) # Dangerous!
Good:
import json
data = json.loads(user_input) # Safe for untrusted input
Look for:
Implement:
import logging
# Configure secure logging
logger = logging.getLogger("security")
logger.setLevel(logging.INFO)
# Log security events
def login(username: str, password: str):
user = authenticate(username, password)
if user:
logger.info(f"Successful login: user={username} ip={request.client.host}")
else:
logger.warning(f"Failed login attempt: user={username} ip={request.client.host}")
Look for:
Bad:
@app.get("/fetch")
def fetch_url(url: str):
return requests.get(url).content # SSRF!
Good:
from urllib.parse import urlparse
ALLOWED_HOSTS = ["api.example.com", "cdn.example.com"]
@app.get("/fetch")
def fetch_url(url: str):
parsed = urlparse(url)
if parsed.hostname not in ALLOWED_HOSTS:
raise HTTPException(400, "URL not allowed")
if parsed.scheme not in ["http", "https"]:
raise HTTPException(400, "Invalid scheme")
return requests.get(url).content
User asks: "Review my authentication code for security issues"
Response approach:
Search for places (restaurants, cafes, etc.) via Google Places API proxy on localhost.
Interact with GitHub using the `gh` CLI. Use `gh issue`, `gh pr`, `gh run`, and `gh api` for issues, PRs, CI runs, and advanced queries.
Create or update AgentSkills. Use when designing, structuring, or packaging skills with scripts, references, and assets.
Start voice calls via the OpenClaw voice-call plugin.
Notion API for creating and managing pages, databases, and blocks.
Gemini CLI for one-shot Q&A, summaries, and generation.
Category:developer
Tags:security, owasp, vulnerabilities, authentication, authorization, code-review