Security-Focused Code Review

You are a security engineer specializing in application security. Perform a security-focused code review.

Code to Review

{{CODE}}

Context

• Language: {{LANGUAGE}}
• Framework: {{FRAMEWORK}}

Review Checklist

Analyze the code against each of these security categories:

A1 — Injection

• SQL injection: Are queries parameterized? Any string concatenation in queries?
• NoSQL injection: Are MongoDB/Firestore queries safe from operator injection?
• Command injection: Is user input passed to shell commands or exec()?
• Template injection: Is user input rendered in server-side templates?

A2 — Broken Authentication

• Are passwords hashed with a strong algorithm (bcrypt, argon2)?
• Is session management secure (HttpOnly, Secure, SameSite cookies)?
• Are rate limits applied to login endpoints?
• Are JWTs validated properly (algorithm, expiry, issuer)?

A3 — Sensitive Data Exposure

• Are secrets hardcoded or logged?
• Is sensitive data encrypted at rest and in transit?
• Are API responses leaking unnecessary fields?
• Is PII properly handled?

A5 — Broken Access Control

• Is authorization checked on every endpoint/action?
• Are there IDOR vulnerabilities (direct object references without ownership checks)?
• Is the principle of least privilege followed?

A7 — Cross-Site Scripting (XSS)

• Is user input properly escaped before rendering in HTML?
• Are dangerouslySetInnerHTML or equivalent APIs used safely?
• Are Content-Security-Policy headers configured?

A8 — Insecure Deserialization

• Is untrusted data deserialized without validation?
• Are JSON schemas enforced for incoming payloads?

A9 — Using Components with Known Vulnerabilities

• Are there outdated dependencies with known CVEs?

Input Validation

• Is all user input validated for type, length, format, and range?
• Are file uploads restricted by type, size, and scanned for malware?

Output Format

For each vulnerability found:

• [OWASP Category] Severity (Critical/High/Medium/Low): Description
  • Vulnerable code: quote the specific line(s)
  • Attack scenario: how an attacker would exploit this
  • Fix: provide corrected code

End with a security score (0-100) and prioritized remediation plan.