security-reviewlisted

Use when performing a security review or triaging findings before launch. The repeatable method with justified N/A, the finding format, prioritization and the readiness ledger, plus the recurring rule sets: tokens in browsers, cryptographically secure random values, user-supplied paths and names, output/errors/rendering, and authorization structure. An audit whose output format changes each time cannot show whether the system is getting safer.
konradcinkusz/architecture-standards · ★ 0 · Code & Development · score 70

Install: claude install-skill konradcinkusz/architecture-standards

# Security review: the method and the recurring rules **Read [`references/SECURITY-REVIEW.md`](references/SECURITY-REVIEW.md) before applying any of this.** That file is the standard; everything below it is a summary to help you decide whether this skill applies and to check your work afterwards. Reference-architecture principles: P5. ## What this standard covers - The review method - The finding format - Prioritization and the readiness ledger - Rule set: tokens in browsers - Rule set: random values - Rule set: user-supplied paths and names - Rule set: output, errors and rendering - Rule set: authorization structure - Recurring launch blockers ## Checklist - [ ] Category list worked through; every N/A justified with evidence; positive findings recorded; pentest caveat stated - [ ] Findings in the standard format, each with an attack scenario - [ ] Time-windowed priorities; status ledger with context column; blocks-deploy vs before-deploy split; residual risks listed - [ ] No tokens in web storage; cookies set server-side; signature verification at every gate; header set present - [ ] CSPRNG for anything presentable as proof; password-hash parameters recorded - [ ] Path/name validation spec applied server-side, mirrored client-side - [ ] Encode at render; markdown sanitized; Swagger off in production - [ ] Deny-by-default with a short `[AllowAnonymous]` list; endpoint × role matrix produced; no identity-by-email; CORS origins explicit - [ ] The four recurring launch blo