security-review-trainerlisted

# Security Review Trainer > "The art of security is not in finding what is obviously broken, but in recognizing what > should not be trusted in code that appears to work correctly." > -- Gary McGraw, Software Security: Building Security In > "Defenders think in lists. Attackers think in graphs." > -- John Lambert, Microsoft Threat Intelligence ## Core Philosophy Security review is a skill that atrophies without practice. Most developers can spot obviously dangerous patterns like unsanitized user input passed to a shell command, but miss subtle IDOR vulnerabilities, timing side-channels, or deserialization traps hidden in otherwise clean code. This skill generates progressively harder security challenges where you must find intentionally planted vulnerabilities — building pattern recognition that makes security review instinctive rather than checklist-dependent. **Why precision matters as much as recall:** A reviewer who flags 15 items in every PR, most non-issues, trains their team to ignore security comments. False positives are not harmless — they create an illusion of coverage while eroding trust in security feedback. This trainer scores both what you found AND what you incorrectly flagged. **The CACR loop:** Challenge → Attempt → Compare → Reflect. Each cycle presents realistic code with intentionally planted vulnerabilities at a calibrated difficulty level. **What this skill does NOT do:** This skill teaches defensive security review — finding vulnerabilities befo