Security reviewer
Skill hamza-ali-shahjahan/hamzaish/factory/agents/mvp/security-reviewer
Your Claude Code setup that builds, launches, and learns — across the whole product lifecycle. Point Claude Code at this and it runs your whole startup factory — and gets smarter every session. Works with Cursor, Codex & Windsurf too.
npx -y skills add hamza-ali-shahjahan/hamzaish --skill security-reviewerAssembled from the repository path, not quoted from the project. Check it against their README if it does not work.
One thing to look at
- 5 stars5 stars. Stars are a popularity signal and not a quality one, but at this level it is likely that nobody has read this closely except its author, and you would be relying on your own review.
What its author says it does
Copied from the file, not written here
Pre-launch security review covering auth, data exposure, input validation, and dependency vulns. Produces a remediation list, not a "looks good" stamp.
SKILL.md
2.7 KB, 661 tokens by cl100k_base, as published. Nobody here has run it
Security Reviewer
When you activate
- Before ANY product first lets real (non-Hamza) users in
- Before any production deploy that touches auth or payment logic
- Quarterly for products at Launch+ stage
What you produce
A remediation list saved to products/<name>/decisions/security-review-YYYY-MM-DD.md:
## Security Review — <product> — <date>
### Auth & session
- [ ] <finding> — severity: <crit|high|med|low> — <how to fix>
### Data exposure (API responses, error messages, logs)
- [ ] ...
### Input validation & injection
- [ ] ...
### Secrets & env hygiene
- [ ] ...
### Dependencies & CVEs
- [ ] ...
### Headers, CORS, CSP
- [ ] ...
### Webhooks & external integrations
- [ ] ...
### Rate limiting & abuse
- [ ] ...
## Severity guide
- Critical: ship-blocker (data leak, auth bypass, secret in repo)
- High: fix before next release
- Medium: fix in next sprint
- Low: backlog with date
## Verdict
- BLOCK launch / deploy until <list of critical items> resolved
- OR: clear to ship; medium-and-below items go in the backlog
Protocol
- Read the product's
CLAUDE.mdto know the stack and patterns. - Read
package.jsonandpnpm-lock.yamlfor dependency baseline. - Run through this checklist:
- Auth: Are session cookies httpOnly + secure + sameSite? Are reset flows rate-limited? Are tokens scoped?
- API responses: Does any endpoint leak user fields (passwords, internal IDs, other-user data) via Supabase RLS gaps?
- Input: Are all server-side handlers using zod or equivalent validation? Are SQL params parameterized? Are file uploads scoped?
- Secrets: Anything in the repo that should be in env?
git log -pstyle scan for accidental commits..env*in gitignore? - Deps: Run
pnpm auditmentally — known-vuln packages? Outdated > 1 year? - Headers: Is CSP set? HSTS? X-Frame-Options? Use
securityheaders.com-equivalent checklist. - Webhooks: Stripe webhook signature verified? Inngest signing key validated?
- Rate limiting: Public endpoints have basic limits?
- For each issue: severity, exact location (file:line), and the fix.
- Force a verdict.
Sources
factory/playbooks/mvp-stage/security-checklist.mdfactory/playbooks/ai-native-2026/founders-playbook-distilled.md(re: insecure by inexperience)
What you don't do
- Don't say "looks good" without going through the checklist.
- Don't grade on a curve. AI-generated code passes functional tests; security failures are silent.
- Don't substitute for a real audit at the Scale stage. You're a first-pass.
What ships with it
Read from the repository
Just SKILL.md. No reference files, no scripts.
Gives 1 of the 12 instructions most review quality skills give in 661 tokens
Counted across 1,048 of the 1,783 authors here whose files we hold, read 2026-08-07
- Ask questions one at a timein 81 of 1048, across 64 files
- Provide a recommended answer for each questionin 73 of 1048, across 50 files
- Explore the codebase instead of asking answerable questionsin 66 of 1048, across 42 files
- Resolve dependencies between decisions one-by-onein 42 of 1048, across 17 files
- Interview the user relentlessly about the planin 38 of 1048, across 13 files
- Order findings by severityin 31 of 1048
- Resolve each branch of the decision treein 27 of 1048, across 5 files
- Run a grilling sessionin 26 of 1048, across 5 files
- Update CONTEXT.md immediately when a term is resolvedin 26 of 1048, across 11 files
- Propose precise canonical terms for vague languagein 25 of 1048, across 7 files
- Create documentation files lazilyin 24 of 1048, across 5 files
- Assign severity to every findinghere, and in 24 of 1048
Said here and by no other author read
- activate before real users access a product
- activate before production deploys touching auth or payments
- save a remediation list to a decisions file
- read project files to understand the stack
- read dependency manifests
- run through the security checklist
Grouped from the skills themselves: near-identical wordings counted once, and counted by distinct author, so one author publishing three of these counts once. Length counted with cl100k_base; the agent that loads this file may tokenize it differently.