What problem does it solve? Code written quickly often ships with security flaws like hardcoded secrets, missing authentication checks, and silently swallowed errors. This Skill provides a structured security review checklist to catch these vulnerabilities before they reach production. ## Core Features & Use Cases - Secrets Detection: Scans source code for hardcoded .env variables, API keys, Stripe tokens, and database URLs. - Authentication & IDOR Review: Verifies FastAPI endpoints use dependency injection like Depends(get_current_user) and that users can only access resources they own. - Error Handling & CORS Audit: Flags try/except blocks that only log errors without returning proper HTTP status codes, and checks CORS configuration on the FastAPI backend. - Use Case: Before merging a pull request for a new flood-report endpoint in the LANES backend, invoke this Skill to confirm the endpoint validates session authenticity and resource ownership. ## Quick Start Ask the AI to run a security review on the changed backend files using the security-agent checklist before deployment.
