secure-code-auditorlisted
Backend security auditor for Django and DRF on an OWASP Top 10 (2025), API Security Top 10 (2023), and ASVS 5.0 foundation. Use when backend code is written or reviewed and touches authentication, sessions, cookies, JWT, OAuth2/OIDC, API keys, password hashing, permissions, access control, IDOR, SSRF, path traversal, open redirect, impersonation, SQL/command/template injection, LDAP, row-level security, encrypted columns, NoSQL, Redis, file uploads, S3, serializers, rate limiting, CSRF/CORS, OpenAPI schema, GraphQL, Django Ninja, gRPC, AI agents, MCP tools, secrets, payments, webhooks, Celery, Django tasks, race conditions, ReDoS, caching, deserialization, async/ASGI, WebSockets, audit logging, erasure, retention, personal data, migrations, JWKS, mutual TLS, SECRET_KEY, SBOM, X-Forwarded-For, SPF/DKIM/DMARC, or deployment config, even if "security" is never used. Review-time returns prioritized findings with fixes; write-time applies secure defaults. Django/DRF-first; general layer suits any stack.
n-shadloo/secure-code-auditor · ★ 4 · API & Backend · score 81
Install: claude install-skill n-shadloo/secure-code-auditor
# secure-code-auditor
A backend security skill. It reviews server-side code, and it applies secure
defaults while new code is written. Django and DRF are the deep specialty. A
stack-neutral layer under them suits any backend. The scope is the backend:
server-side code, data, configuration, and the deployment the backend owns.
Browser and frontend concerns stay out, except where the server controls the
output. Other agents (Codex, Cursor, Gemini CLI) reuse this content through
`AGENTS.md`, with Claude as the primary integration.
## How the reference material is organized
Everything sits on the **OWASP Top 10:2025 spine**. Each reference has two
layers. The **principle layer** states the vulnerability and the defense in
stack-neutral terms. The **Django & DRF layer** holds the settings, the code
patterns, the correct and wrong examples, and the gotchas. A sub-topic
checklist splits the same way, into `#### Stack-neutral` and `#### Django &
DRF`. A file's final `## Review checklist` may stay unsplit, and neither form
is a defect.
Every control is stated in two grammars. The review form says what to flag.
The write-time form says what to write, in a paragraph that opens
`**Write-time.**` directly under the control it completes. Every reference
that owns a control carries at least one. The two that do not are the
methodology file and the library index.
Load only the file for the concern in front of you. Pick the group, then the
row. Where two rows could both match, the owners