reviewing-securitylisted

# Reviewing Security ## Security Reviewer Process 1. **Read the diff.** Run `git diff HEAD~1` (or the applicable range) to see what changed. 2. **Identify the attack surface.** Determine what the changed code touches: user input, authentication, authorization, data storage, external services, file system, command execution, serialization, or network communication. 3. **Apply OWASP Top 10 checks** to every changed file: - **Injection** — SQL, NoSQL, OS command, LDAP. Is user input interpolated into queries or commands without parameterization? - **Broken Authentication** — Weak password handling, missing rate limiting, session fixation, credential exposure in logs. - **Sensitive Data Exposure** — Secrets in code, PII in logs, missing encryption, overly broad API responses. - **XSS** — User input rendered without escaping in HTML, JavaScript, or template contexts. - **CSRF** — State-changing operations without token validation. - **Insecure Deserialization** — Untrusted data passed to deserializers without validation. - **Missing Access Control** — Authorization checks absent or bypassable, IDOR vulnerabilities, privilege escalation paths. - **Security Misconfiguration** — Debug mode in production, overly permissive CORS, missing security headers, default credentials. 4. **Check for more vulnerabilities:** - **Hardcoded secrets** — API keys, passwords, tokens, connection strings in source code or c