auditing-securitylisted

# Auditing security Analyze for real, evidenced risk — never run destructive or intrusive tests against systems you don't have explicit authorization to test that way. See [enforcing-safety-baseline](../enforcing-safety-baseline/SKILL.md) for the shared safety policy this skill enforces most strictly. ## Areas to analyze (as applicable to the code in scope) - **Authentication** — session/token handling, password storage (hashing algorithm, no plaintext), MFA bypass paths, token expiry/revocation. - **Authorization** — every privileged action checks the caller's actual permission, not just that they're logged in; no client-side-only authorization. - **IDOR** — object references (IDs in URLs/bodies) are checked against the caller's ownership/tenant before use, not trusted as-is. - **Tenant isolation / RLS** — every query touching tenant-scoped data is scoped correctly; for Postgres/Supabase, RLS policies exist and actually restrict by tenant (read the policy, don't assume it's correct because it exists). - **Injection** — SQL/NoSQL/command injection: parameterized queries vs. string concatenation, unsafe `eval`/`exec`. - **XSS** — unescaped user input rendered in HTML/JS contexts, unsafe use of `dangerouslySetInnerHTML`/`innerHTML`/`v-html`. - **CSRF** — state-changing endpoints protected by tokens or same-site cookies where relevant. - **SSRF** — server-side requests built from user-controlled URLs without allowlisting. - **Secrets** — hardcoded credentials/keys in code or