review-security-codelisted

# Review: Security Code (Code-Level Vulnerabilities) ## Purpose Finds exploitable security vulnerabilities introduced in the changed code of the current branch. Covers injection, auth/authz gaps, IDOR, secrets, insecure crypto, CSRF, path traversal, and framework-specific patterns (NestJS, React). Produces findings with explicit attack vectors and concrete fixes. This skill covers **code-level security only**. It does NOT audit npm/bun dependency trees, Docker configurations, or deployment surfaces — use `security-audit` for those. --- ## Input Contract | Field | Required | Description | |-------|----------|-------------| | Branch / diff range | No | Defaults to merge-base..HEAD + uncommitted changes | | Explicit commit hash/range | No | Review only that range when provided | | `JOB_NAME` | No | Job name when dispatched by orchestrator | | `CONTEXT_PATH` | No | Path to context doc when dispatched by orchestrator | --- ## Scope Boundaries | Concern | This skill | Use instead | |---------|-----------|-------------| | Injection (SQL, XSS, command, SSTI) | YES | — | | Auth/authz gaps, IDOR, privilege escalation | YES | — | | Missing input validation / DTO validation | YES | — | | Hardcoded secrets, logging secrets | YES | — | | Insecure cryptography (MD5, SHA1, weak random) | YES | — | | CSRF, path traversal, open redirect | YES | — | | OWASP Top 10 code patterns | YES | — | | NestJS-specific: missing guards, unvalidated DTOs | YES | — | | React-specific: dangerouslySetI