skills.rest
clfigueiredo
clfigueiredoCOMMUNITY
Explore all skills by this author →
GitHub

security-review-webapp

Reviews web application code against a practical security checklist covering secrets, input validation, authentication, and web attack vectors.

5|15|Updated Jul 8, 2026
Search Tags:#checklist#authentication#vulnerability#owasp#security review#code audit#webapp
One-click install
npx skills add https://github.com/clfigueiredo/hermes-infra-skills --skill security-review-webapp-clfigueiredo
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: security-review-webapp
Source: https://github.com/clfigueiredo/hermes-infra-skills/tree/main/.hermes/skills/curso-hermes/security-review-webapp
Command: npx skills add https://github.com/clfigueiredo/hermes-infra-skills --skill security-review-webapp-clfigueiredo

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve? Developers shipping authentication, APIs, uploads, payments, or admin panels often miss critical security flaws before going live. This Skill applies a structured web security checklist so vulnerabilities are caught and documented before deployment. ## Core Features & Use Cases - Practical Security Checklist: Covers secrets management, input validation, authentication/authorization, and web-specific risks like CSRF, XSS, CORS, and rate limiting. - Structured Findings Format: Reports each issue with file and line, severity, impact, concrete fix, and a verification test. - Severity Classification: Ranks findings as Critical, High, Medium, or Low based on real attacker impact. - Use Case: Before publishing a new login API with file upload, run the review to confirm no hardcoded secrets, parameterized queries, server-side permission checks, and rate limiting on sensitive endpoints. ## Quick Start Review my web application code for security issues before I deploy the new authentication and payment endpoints.

Frequently Asked Questions about security-review-webapp

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I review my web app for security vulnerabilities before deployment?▼

Run a structured checklist covering secrets, input validation, authentication, authorization, and web risks like CSRF, XSS, CORS, and rate limiting. Each finding should include file and line, severity, impact, a concrete fix, and a test proving the fix works.

What should a web application security checklist include?▼

It should cover hardcoded secrets and .env handling, schema-validated inputs, parameterized SQL queries, upload size and type limits, server-side permission checks, session expiration, CSRF protection, XSS prevention, restricted CORS, and rate limits on login and sensitive APIs.

How do I classify the severity of a security finding?▼

Classify by attacker impact: Critical for breaches, data leaks, money, or admin access; High for auth bypass or dangerous execution; Medium for limited abuse, enumeration, or missing rate limits; Low for hardening, messages, and headers.

Can this checklist replace a penetration test or security audit?▼

No. It is a pre-publication review checklist, not a substitute for professional penetration testing. It never declares code "secure" without evidence and explicitly states what was verified and what was not checked.

When should I run a security review on my code?▼

Run it whenever you create authentication, a new API, file upload, payment or webhook handling, an admin dashboard, or any code touching personal or sensitive data, and always before a public deploy.

Related Skills

Explore More Software Engineering Skills→
insightriotinsightriot
1

security-and-hardening

Applies security-first coding practices covering OWASP prevention, input validation, and secrets management.

Official
Intermediate
nok0321nok0321

robust-fix

Automatically fix S-Critical and S-High findings from robust-review with verification gates.

Community
Advanced
nirholasnirholas
113

pump-testing

Run Rust, TypeScript, and Python tests for the Pump SDK.

Community
Advanced
wojonswojons
4

testing-security

Test applications and infrastructure for security vulnerabilities and weaknesses.

Community
Advanced