security-review

原文涵盖的主题

• Security Review Skill
• When to Activate
• Security Checklist
• 1. Secrets Management
• FAIL: NEVER Do This
• PASS: ALWAYS Do This
• Verification Steps
• 2. Input Validation

This skill ensures all code follows security best practices and identifies potential vulnerabilities. Implementing authentication or authorization Handling user input or file uploads Creating new API endpoints Working with secrets or credentials Implementing payment features Storing or transmitting sensitive data Integrating third-party APIs [ ] No hardcoded API keys, tokens, or passwords [ ] All secrets in environment variables [ ] .env.local in .gitignore [ ] No secrets in git history [ ] Production secrets in hosting platform (Vercel, Railway) [ ] All user inputs validated with schemas [ ] File uploads restricted (size, type, extension) [ ] No direct use of user input in queries [ ] Whitelist validation (not blacklist) [ ] Error messages don't leak sensitive info [ ] All database queries use parameterized queries [ ] No string concatenation in SQL [ ] ORM/query builder used correctly [ ] Supabase queries properly sanitized [ ] Tokens stored in httpOnly cookies (not localStorage) [ ] Authorization checks before sensitive operations [ ] Row Level Security enabled in Supabase [ ] Role-based access control implemented [ ] Session management secure [ ] User-provided HTML sanitized [

这里只展示节选，请以完整原文和当前要求为准。