What problem does it solve? Security reviews are often ad-hoc and inconsistent, missing critical vulnerabilities in authentication, authorization, encryption, and configuration. This Skill provides a systematic, standards-based framework for conducting security audits, threat modeling, and compliance verification so no major risk category is overlooked. ## Core Features & Use Cases - Azure WAF Security Pillar Checklist: Walks through all twelve security design controls (SE:01–SE:12) covering baselines, IAM, encryption, secret management, and incident response. - OWASP Top 10:2025 Assessment: Evaluates code against all ten vulnerability categories with concrete vulnerable-vs-secure TypeScript/Next.js code patterns. - Tiered Review Depths: Offers quick (15 min), standard (1–2 hour), and comprehensive (1+ day) review checklists plus a severity-rated report template. - Use Case: Before launching a Next.js application, run a standard security review to verify authorization checks in Server Actions, security headers in next.config.js, secret handling, and dependency auditing, then produce a findings report with remediation guidance. ## Quick Start Ask the agent to perform a security review of your Next.js application using the OWASP Top 10 and Azure WAF checklists and generate a findings report.
