Back to Details

security-review

Compare original and translation side by side

🇺🇸

Original

English
🇨🇳

Translation

Chinese

Security Review

安全审查

Overview

概述

Dedicated security review for code handling authentication, authorization, user input, APIs, databases, or credentials.
Core principle: Security issues require specialized attention beyond general code review.
Trigger: This review is MANDATORY when changes touch security-sensitive paths.
Announce at start: "I'm performing a security review of this code."
针对处理身份验证、授权、用户输入、API、数据库或凭据的代码进行专门的安全审查。
核心原则： 安全问题需要专门处理，不能仅依赖常规代码审查。
触发条件： 当变更触及安全敏感路径时，此审查为强制要求。
开始时声明： “我正在对这些代码进行安全审查。”

When Required

何时必须执行

This skill is MANDATORY when ANY of these files are modified:
PatternExamples
**/auth/**
src/auth/login.ts, lib/auth/session.js
**/security/**
src/security/encryption.ts
**/middleware/**
src/middleware/authenticate.ts
**/api/**
src/api/endpoints.ts
**/*password*
utils/passwordHash.ts
**/*token*
services/tokenService.ts
**/*secret*
config/secrets.ts
**/*credential*
lib/credentials.js
**/*session*
middleware/session.ts
**/routes/**
src/routes/protected.ts
**/*.sql
migrations/001_users.sql
Check with:
bash
git diff --name-only HEAD~1 | grep -E '(auth|security|middleware|api|password|token|secret|credential|session|routes|\.sql)'
当修改以下任一文件时，此 skill 为强制要求：
模式示例
**/auth/**
src/auth/login.ts, lib/auth/session.js
**/security/**
src/security/encryption.ts
**/middleware/**
src/middleware/authenticate.ts
**/api/**
src/api/endpoints.ts
**/*password*
utils/passwordHash.ts
**/*token*
services/tokenService.ts
**/*secret*
config/secrets.ts
**/*credential*
lib/credentials.js
**/*session*
middleware/session.ts
**/routes/**
src/routes/protected.ts
**/*.sql
migrations/001_users.sql
使用以下命令检查：
bash
git diff --name-only HEAD~1 | grep -E '(auth|security|middleware|api|password|token|secret|credential|session|routes|\.sql)'

OWASP Top 10 Checklist

OWASP Top 10 检查清单

Review against each category:
针对每个类别进行检查：

1. Injection (A03:2021)

1. 注入（Injection，A03:2021）

CheckVerify
SQL InjectionAll queries use parameterized statements
Command InjectionNo user input in shell commands, or properly escaped
LDAP InjectionLDAP queries use proper escaping
XPath InjectionXPath queries use parameterized approach
Template InjectionTemplate engines configured safely
typescript
// VULNERABLE
db.query(`SELECT * FROM users WHERE id = '${userId}'`);

// SECURE
db.query('SELECT * FROM users WHERE id = ?', [userId]);
检查项验证方式
SQL 注入所有查询均使用参数化语句
命令注入shell 命令中不包含用户输入，或已正确转义
LDAP 注入LDAP 查询使用正确的转义方式
XPath 注入XPath 查询采用参数化方式
模板注入模板引擎已安全配置
typescript
// VULNERABLE
db.query(`SELECT * FROM users WHERE id = '${userId}'`);

// SECURE
db.query('SELECT * FROM users WHERE id = ?', [userId]);

2. Broken Authentication (A07:2021)

2. 身份验证失效（Broken Authentication，A07:2021）

CheckVerify
Password StoragePasswords hashed with bcrypt/argon2 (not MD5/SHA1)
Session ManagementSecure, HttpOnly, SameSite cookies
Token HandlingJWTs signed, validated, short-lived
Brute Force ProtectionRate limiting on auth endpoints
Credential ExposureNo credentials in logs, errors, or responses
检查项验证方式
密码存储密码使用 bcrypt/argon2 哈希，而非 MD5/SHA1
Session 管理使用安全的、具备 HttpOnly 和 SameSite 属性的 Cookie
Token 处理JWT 已签名、经过验证且有效期短
暴力破解防护身份验证端点启用速率限制
凭据暴露日志、错误或响应中不包含凭据

3. Sensitive Data Exposure (A02:2021)

3. 敏感数据暴露（Sensitive Data Exposure，A02:2021）

CheckVerify
Data in TransitHTTPS enforced, TLS 1.2+
Data at RestSensitive data encrypted
Secrets in CodeNo hardcoded API keys, passwords, tokens
Error MessagesNo sensitive info in error responses
LoggingNo sensitive data logged
bash
undefined
检查项验证方式
传输中的数据强制使用 HTTPS 和 TLS 1.2+
静态数据敏感数据已加密
代码中的 Secret不存在硬编码的 API key、密码或 token
错误消息错误响应中不包含敏感信息
日志不记录敏感数据
bash
undefined

Check for hardcoded secrets

Check for hardcoded secrets

grep -rE '(password|secret|api_key|token)\s*[:=]\s*["\047][^"\047]+["\047]' src/
undefined
grep -rE '(password|secret|api_key|token)\s*[:=]\s*["\047][^"\047]+["\047]' src/
undefined

4. XML External Entities (A05:2021)

4. XML 外部实体（XML External Entities，A05:2021）

CheckVerify
XML ParsingExternal entities disabled
DTD ProcessingDTD processing disabled if not needed
检查项验证方式
XML 解析已禁用外部实体
DTD 处理如无需要，已禁用 DTD 处理

5. Broken Access Control (A01:2021)

5. 访问控制失效（Broken Access Control，A01:2021）

CheckVerify
Authorization ChecksEvery endpoint verifies permissions
Direct Object ReferencesObject access validated against user
Privilege EscalationCannot elevate own privileges
CORSProperly restricted origins
Method RestrictionOnly allowed HTTP methods accepted
检查项验证方式
授权检查每个端点均验证权限
直接对象引用根据用户验证对象访问权限
权限提升用户无法提升自身权限
CORS已正确限制允许的 origin
方法限制仅接受允许的 HTTP 方法

6. Security Misconfiguration (A05:2021)

6. 安全配置错误（Security Misconfiguration，A05:2021）

CheckVerify
Default CredentialsNo default passwords in use
Error HandlingStack traces not exposed to users
Security HeadersCSP, X-Frame-Options, etc. set
Debug ModeDisabled in production
Unnecessary FeaturesUnused endpoints/features removed
检查项验证方式
默认凭据未使用默认密码
错误处理不向用户暴露堆栈跟踪信息
安全标头已设置 CSP、X-Frame-Options 等标头
调试模式生产环境中已禁用
不必要的功能已移除未使用的端点或功能

7. Cross-Site Scripting (A03:2021)

7. 跨站脚本（Cross-Site Scripting，A03:2021）

CheckVerify
Output EncodingUser input encoded before display
DOM XSSinnerHTML not used with user input
Template SafetyTemplate engine auto-escapes
CSPContent Security Policy configured
typescript
// VULNERABLE
element.innerHTML = userInput;

// SECURE
element.textContent = userInput;
// OR
element.innerHTML = DOMPurify.sanitize(userInput);
检查项验证方式
输出编码用户输入在显示前经过编码
DOM XSS不将用户输入直接赋给 innerHTML
模板安全模板引擎自动转义
CSP已配置 Content Security Policy
typescript
// VULNERABLE
element.innerHTML = userInput;

// SECURE
element.textContent = userInput;
// OR
element.innerHTML = DOMPurify.sanitize(userInput);

8. Insecure Deserialization (A08:2021)

8. 不安全反序列化（Insecure Deserialization，A08:2021）

CheckVerify
Object DeserializationUntrusted data not deserialized
JSON ParsingSafe JSON.parse usage
Type ValidationDeserialized objects validated
检查项验证方式
对象反序列化不对不可信数据进行反序列化
JSON 解析安全使用 JSON.parse
类型验证已验证反序列化对象

9. Using Components with Known Vulnerabilities (A06:2021)

9. 使用存在已知漏洞的组件（Using Components with Known Vulnerabilities，A06:2021）

CheckVerify
Dependency Audit
pnpm audit
/ 
pip audit
clean
Outdated PackagesNo critically outdated dependencies
CVE CheckNo known CVEs in dependencies
bash
undefined
检查项验证方式
依赖项审计
pnpm audit
/ 
pip audit
未发现问题
过期软件包不存在严重过期的依赖项
CVE 检查依赖项中不存在已知 CVE
bash
undefined

Run dependency audit

Run dependency audit

pnpm audit --prod
pnpm audit --prod

or

or

pip-audit
undefined
pip-audit
undefined

10. Insufficient Logging & Monitoring (A09:2021)

10. 日志记录与监控不足（Insufficient Logging & Monitoring，A09:2021）

CheckVerify
Auth EventsLogin success/failure logged
Access ControlPermission denials logged
Input ValidationValidation failures logged
Sensitive ActionsAdmin actions logged
Log IntegrityLogs protected from tampering
检查项验证方式
身份验证事件记录登录成功和失败信息
访问控制记录权限拒绝信息
输入验证记录验证失败信息
敏感操作记录管理员操作
日志完整性日志受到保护，无法被篡改

Review Process

审查流程

Step 1: Identify Security-Sensitive Changes

第 1 步：识别安全敏感变更

bash
undefined
bash
undefined

List changed files matching security patterns

List changed files matching security patterns

git diff --name-only HEAD~1 | grep -E '(auth|security|middleware|api|password|token|secret|session)'
undefined
git diff --name-only HEAD~1 | grep -E '(auth|security|middleware|api|password|token|secret|session)'
undefined

Step 2: Review Each File

第 2 步：审查每个文件

For each security-sensitive file:
  1. Read the entire file (not just diff)
  2. Check against all 10 OWASP categories
  3. Note any findings with severity
对于每个安全敏感文件：
  1. 阅读完整文件，而不只是 diff
  2. 对照全部 10 个 OWASP 类别进行检查
  3. 记录发现的问题及其严重性

Step 3: Check Dependencies

第 3 步：检查依赖项

bash
undefined
bash
undefined

Audit dependencies

Audit dependencies

pnpm audit --prod
pnpm audit --prod

Check for outdated

Check for outdated

pnpm outdated
undefined
pnpm outdated
undefined

Step 4: Document Findings

第 4 步：记录审查发现

Use severity levels:
SeverityDescriptionAction
CRITICALExploitable vulnerability, data breach riskMUST fix before merge
HIGHSignificant security weaknessMUST fix before merge
MEDIUMDefense-in-depth issueSHOULD fix before merge
LOWMinor improvementMAY fix in future issue
使用以下严重性级别：
严重性说明操作
CRITICAL可利用的漏洞，存在数据泄露风险合并前必须修复
HIGH重大安全弱点合并前必须修复
MEDIUM纵深防御问题合并前应该修复
LOW轻微改进项可以在后续 issue 中修复

Step 5: Add Security Section to Review Artifact

第 5 步：在审查产物中添加安全部分

Add to the main review artifact:
markdown
undefined
向主审查产物中添加安全部分：
markdown
undefined

Security Review

Security Review

Security-Sensitive: YES Reviewed By: [WORKER_ID or codex-subagent security-reviewer] OWASP Categories Checked: 10/10
Security-Sensitive: YES Reviewed By: [WORKER_ID or codex-subagent security-reviewer] OWASP Categories Checked: 10/10

Security Findings

Security Findings

#OWASP CategorySeverityFindingStatus
1A03 InjectionCRITICALSQL injection in findUser()FIXED
2A02 Sensitive DataHIGHAPI key in config.tsDEFERRED #456
3A01 Access ControlMEDIUMMissing auth on /adminFIXED
#OWASP CategorySeverityFindingStatus
1A03 InjectionCRITICALSQL injection in findUser()FIXED
2A02 Sensitive DataHIGHAPI key in config.tsDEFERRED #456
3A01 Access ControlMEDIUMMissing auth on /adminFIXED

Dependency Audit

Dependency Audit

pnpm audit: 0 vulnerabilities
Security Review Status: [PASS|ISSUES_FIXED|ISSUES_DEFERRED]
undefined
pnpm audit: 0 vulnerabilities
Security Review Status: [PASS|ISSUES_FIXED|ISSUES_DEFERRED]
undefined

Security Review Artifact (Standalone)

安全审查产物（独立）

If security review is extensive, post as separate comment:
markdown
<!-- SECURITY_REVIEW:START -->
如果安全审查内容较多，可作为单独的评论发布：
markdown
<!-- SECURITY_REVIEW:START -->

Security Review

Security Review

PropertyValue
Issue#123
Reviewer
security-reviewer
subagent (codex-subagent)
Reviewed2025-12-29T10:30:00Z
PropertyValue
Issue#123
Reviewer
security-reviewer
subagent (codex-subagent)
Reviewed2025-12-29T10:30:00Z

Files Reviewed

Files Reviewed

  • src/auth/login.ts
  • src/middleware/authenticate.ts
  • src/api/users.ts
  • src/auth/login.ts
  • src/middleware/authenticate.ts
  • src/api/users.ts

OWASP Checklist Results

OWASP Checklist Results

#CategoryStatusNotes
A01Broken Access ControlPASSAuth middleware on all protected routes
A02Cryptographic FailuresPASSbcrypt for passwords, TLS enforced
A03InjectionFIXEDParameterized SQL queries now
A04Insecure DesignPASS-
A05Security MisconfigurationPASS-
A06Vulnerable ComponentsPASSpnpm audit clean
A07Auth FailuresPASSRate limiting, secure sessions
A08Data Integrity FailuresPASS-
A09Logging FailuresNOTEConsider adding auth failure logging
A10SSRFN/ANo server-side requests
#CategoryStatusNotes
A01Broken Access ControlPASSAuth middleware on all protected routes
A02Cryptographic FailuresPASSbcrypt for passwords, TLS enforced
A03InjectionFIXEDParameterized SQL queries now
A04Insecure DesignPASS-
A05Security MisconfigurationPASS-
A06Vulnerable ComponentsPASSpnpm audit clean
A07Auth FailuresPASSRate limiting, secure sessions
A08Data Integrity FailuresPASS-
A09Logging FailuresNOTEConsider adding auth failure logging
A10SSRFN/ANo server-side requests

Dependency Audit

Dependency Audit

found 0 vulnerabilities
Security Review Status: PASS
<!-- SECURITY_REVIEW:END --> 
undefined
found 0 vulnerabilities
Security Review Status: PASS
<!-- SECURITY_REVIEW:END --> 
undefined

Checklist

检查清单

Before completing security review:
  • All changed security-sensitive files reviewed
  • All 10 OWASP categories checked
  • Dependency audit run
  • All CRITICAL/HIGH findings fixed
  • Any deferred findings have tracking issues
  • Security section added to review artifact
  • Security-Sensitive marked YES in main artifact
完成安全审查前，确认以下事项：
  • 已审查所有变更过的安全敏感文件
  • 已检查全部 10 个 OWASP 类别
  • 已运行依赖项审计
  • 所有 CRITICAL/HIGH 问题均已修复
  • 所有延期处理的问题均有跟踪事项
  • 已在审查产物中添加安全部分
  • 已在主产物中将 Security-Sensitive 标记为 YES

Integration

集成

This skill is triggered by:
  • Changes to security-sensitive file patterns
  • Explicit invocation
  • codex-subagent security-reviewer
This skill integrates with:
  • comprehensive-review
    - Security is criterion #4
  • review-gate
    - Verifies security review for sensitive changes
This skill is enforced by:
  • .codex/rules/security-sensitive.md
    conditional rules
  • PR gate automation (block PR if security-sensitive without review)
此 skill 的触发方式包括：
  • 变更涉及安全敏感文件模式
  • 显式调用
  • codex-subagent security-reviewer
此 skill 与以下功能集成：
  • comprehensive-review
    ——安全是第 4 项标准
  • review-gate
    ——验证安全敏感变更是否已完成安全审查
此 skill 通过以下机制强制执行：
  • .codex/rules/security-sensitive.md
    条件规则
  • PR 门禁自动化（若安全敏感变更未经过审查，则阻止 PR）