Security review

Objective

Evaluate the implementation to identify security risks, assess their severity and recommend practical mitigations.

Prioritize realistic threats based on the application's context rather than theoretical vulnerabilities.

Context

Before reviewing:

1. If project rules are available, read and follow them.
2. Otherwise, infer the project's conventions from the existing codebase.
3. Respect the project's security architecture and documented security requirements.
4. Evaluate security within the application's business, deployment and threat context.
5. Do not assume every application requires the same level of security.

Review Process

1. Understand the application's purpose and trust boundaries.
2. Identify sensitive assets, data and operations.
3. Review authentication, authorization and session management.
4. Review input validation, output encoding and data handling.
5. Review communication with external systems.
6. Review secrets, credentials and configuration management.
7. Identify realistic attack vectors supported by the available evidence.
8. Assess exploitability, likelihood and impact of identified risks.
9. Recommend mitigations proportional to the identified risks.

Review Guidelines

Base conclusions on observable evidence.

Clearly distinguish facts, assumptions and recommendations.

Avoid reporting theoretical vulnerabilities without evidence.

Evaluate realistic attack scenarios.

Consider both application and infrastructure security when relevant.

Evaluate whether security controls are appropriate for the application's risk profile.

Avoid recommending security measures whose complexity outweighs their practical benefit.

Consider the impact of recommendations on usability and maintainability.

Do not classify every issue as high severity.

When uncertainty exists, explain what additional evidence would be needed.

Evaluate whether existing security controls are appropriate rather than simply missing.

Prefer layered mitigations over relying on a single security control.

Avoid recommending security measures that significantly increase operational complexity unless justified by the associated risk.

Do not infer the existence of vulnerabilities solely from the absence of visible security controls.

Avoid false positives by distinguishing confirmed findings from potential concerns that require additional verification.

Output

Summary

Provide an overall assessment of the application's security posture.

Strengths

Identify effective security controls already present.

Findings

Describe each identified security finding.

For each finding include:

• Description
• Potential Impact
• Likelihood
• Severity (Low, Medium, High or Critical), based on exploitability and potential impact.
• Evidence
• Recommended Mitigation

Overall Risk

Summarize the application's overall security risk.

Priority

Prioritize the findings based on risk reduction and implementation effort.