Prompt file imported from fabioc-aloha/alex-cognitive-architecture (.github/prompts/loop/security.prompt.md). Copyright stays with the author.

Security Review

Name: security
Author: fabioc-aloha

Comprehensive security review covering dependencies, secrets, configuration, and code.

What I Check

1. Dependency Security

npm audit        # Node.js
pip-audit        # Python
cargo audit      # Rust
dotnet list package --vulnerable  # .NET

Known CVEs in dependencies
Outdated packages with security fixes
Suspicious or typo-squatted packages

2. Secret Detection

Scan for accidentally committed secrets:

API keys, tokens
Passwords, connection strings
Private keys, certificates
.env files in git

3. Configuration Security

Are defaults secure?
Is HTTPS enforced?
Are CORS settings appropriate?
Are error messages sanitized?

4. Code Patterns

Input validation present?
Output encoding/escaping?
SQL parameterization?
Authentication/authorization checks?
Logging sensitive data?

OWASP Top 10 Quick Check

#	Risk	Quick Check
1	Broken Access Control	Auth checks on all endpoints?
2	Cryptographic Failures	Secrets in code? Weak crypto?
3	Injection	User input sanitized?
4	Insecure Design	Threat model exists?
5	Security Misconfiguration	Debug mode in prod?
6	Vulnerable Components	npm audit clean?
7	Auth Failures	Session management solid?
8	Data Integrity Failures	Updates signed?
9	Logging Failures	Security events logged?
10	SSRF	URL validation?

Security Report

SECURITY REVIEW REPORT
======================
Project: [name]
Date: [date]
Reviewer: Alex

SUMMARY:
Critical: [count] | High: [count] | Medium: [count] | Low: [count]

FINDINGS:

### [Finding 1]
**Severity**: Critical
**Category**: [OWASP category]
**Location**: [file:line]
**Description**: [what's wrong]
**Remediation**: [how to fix]
**References**: [CVE, docs, etc.]

### [Finding 2]
...

DEPENDENCY AUDIT:
| Package | Severity | CVE | Fix Version |
|---------|----------|-----|-------------|

RECOMMENDATIONS:
1. [Immediate action]
2. [Short-term fix]
3. [Long-term improvement]

OVERALL RISK: [Low/Medium/High/Critical]

Severity Definitions

Level	Definition
Critical	Exploitable now, high impact
High	Likely exploitable, significant impact
Medium	Exploitable with effort, moderate impact
Low	Difficult to exploit, low impact

Run security review on this project?

# Security Review Comprehensive security review covering dependencies, secrets, configuration, and code. ## What I Check ### 1. Dependency Security ```bash npm audit # Node.js pip-audit # Python cargo audit # Rust dotnet list package --vulnerable # .NET ``` - Known CVEs in dependencies - Outdated packages with security fixes - Suspicious or typo-squatted packages ### 2. Secret Detection Scan for accidentally committed secrets: - API keys, tokens - Passwords, connection strings - Private keys, certificates - `.env` files in git ### 3. Configuration Security - Are defaults secure? - Is HTTPS enforced? - Are CORS settings appropriate? - Are error messages sanitized? ### 4. Code Patterns - Input validation present? - Output encoding/escaping? - SQL parameterization? - Authentication/authorization checks? - Logging sensitive data? ## OWASP Top 10 Quick Check | # | Risk | Quick Check | |---|------|-------------| | 1 | Broken Access Control | Auth checks on all endpoints? | | 2 | Cryptographic Failures | Secrets in code? Weak crypto? | | 3 | Injection | User input sanitized? | | 4 | Insecure Design | Threat model exists? | | 5 | Security Misconfiguration | Debug mode in prod? | | 6 | Vulnerable Components | npm audit clean? | | 7 | Auth Failures | Session management solid? | | 8 | Data Integrity Failures | Updates signed? | | 9 | Logging Failures | Security events logged? | | 10 | SSRF | URL validation? | ## Security Report ``` SECURITY REVIEW REPORT ====================== Project: [name] Date: [date] Reviewer: Alex SUMMARY: Critical: [count] | High: [count] | Medium: [count] | Low: [count] FINDINGS: ### [Finding 1] **Severity**: Critical **Category**: [OWASP category] **Location**: [file:line] **Description**: [what's wrong] **Remediation**: [how to fix] **References**: [CVE, docs, etc.] ### [Finding 2] ... DEPENDENCY AUDIT: | Package | Severity | CVE | Fix Version | |---------|----------|-----|-------------| RECOMMENDATIONS: 1. [Immediate action] 2. [Short-term fix] 3. [Long-term improvement] OVERALL RISK: [Low/Medium/High/Critical] ``` ## Severity Definitions | Level | Definition | |-------|------------| | **Critical** | Exploitable now, high impact | | **High** | Likely exploitable, significant impact | | **Medium** | Exploitable with effort, moderate impact | | **Low** | Difficult to exploit, low impact | Run security review on this project?

{ "prompt": "# Security Review\n\nComprehensive security review covering dependencies, secrets, configuration, and code.\n\n## What I Check\n\n### 1. Dependency Security\n\n```bash\nnpm audit # Node.js\npip-audit # Python\ncargo audit # Rust\ndotnet list package --vulnerable # .NET\n```\n\n- Known CVEs in dependencies\n- Outdated packages with security fixes\n- Suspicious or typo-squatted packages\n\n### 2. Secret Detection\n\nScan for accidentally committed secrets:\n\n- API keys, tokens\n- Passwords, connection strings\n- Private keys, certificates\n- `.env` files in git\n\n### 3. Configuration Security\n\n- Are defaults secure?\n- Is HTTPS enforced?\n- Are CORS settings appropriate?\n- Are error messages sanitized?\n\n### 4. Code Patterns\n\n- Input validation present?\n- Output encoding/escaping?\n- SQL parameterization?\n- Authentication/authorization checks?\n- Logging sensitive data?\n\n## OWASP Top 10 Quick Check\n\n| # | Risk | Quick Check |\n|---|------|-------------|\n| 1 | Broken Access Control | Auth checks on all endpoints? |\n| 2 | Cryptographic Failures | Secrets in code? Weak crypto? |\n| 3 | Injection | User input sanitized? |\n| 4 | Insecure Design | Threat model exists? |\n| 5 | Security Misconfiguration | Debug mode in prod? |\n| 6 | Vulnerable Components | npm audit clean? |\n| 7 | Auth Failures | Session management solid? |\n| 8 | Data Integrity Failures | Updates signed? |\n| 9 | Logging Failures | Security events logged? |\n| 10 | SSRF | URL validation? |\n\n## Security Report\n\n```\nSECURITY REVIEW REPORT\n======================\nProject: [name]\nDate: [date]\nReviewer: Alex\n\nSUMMARY:\nCritical: [count] | High: [count] | Medium: [count] | Low: [count]\n\nFINDINGS:\n\n### [Finding 1]\n**Severity**: Critical\n**Category**: [OWASP category]\n**Location**: [file:line]\n**Description**: [what's wrong]\n**Remediation**: [how to fix]\n**References**: [CVE, docs, etc.]\n\n### [Finding 2]\n...\n\nDEPENDENCY AUDIT:\n| Package | Severity | CVE | Fix Version |\n|---------|----------|-----|-------------|\n\nRECOMMENDATIONS:\n1. [Immediate action]\n2. [Short-term fix]\n3. [Long-term improvement]\n\nOVERALL RISK: [Low/Medium/High/Critical]\n```\n\n## Severity Definitions\n\n| Level | Definition |\n|-------|------------|\n| **Critical** | Exploitable now, high impact |\n| **High** | Likely exploitable, significant impact |\n| **Medium** | Exploitable with effort, moderate impact |\n| **Low** | Difficult to exploit, low impact |\n\nRun security review on this project?", "variables": [], "notes": "Security review covering deps, secrets, config, and code patterns Mode: agent. Tools: read_file, grep_search, run_in_terminal, list_dir.", "metadata": { "source": { "provider": "github-prompts", "repository": "https://github.com/fabioc-aloha/alex-cognitive-architecture", "path": ".github/prompts/loop/security.prompt.md", "ref": "3a339b9a3c789d56e04d55eaaf83143df3352d14", "url": "https://github.com/fabioc-aloha/alex-cognitive-architecture/blob/3a339b9a3c789d56e04d55eaaf83143df3352d14/.github/prompts/loop/security.prompt.md", "key": "fabioc-aloha/alex-cognitive-architecture/.github/prompts/loop/security.prompt.md" } } }

security

About

Security Review

What I Check

1. Dependency Security

2. Secret Detection

3. Configuration Security

4. Code Patterns

OWASP Top 10 Quick Check

Security Report

Severity Definitions

Use it

Manifest

Reviews