Pre-Release Code Security Audit
Get an evidence-backed code security audit with exploit paths, prioritized fixes, regression tests, and explicit review limits.
Before & after
Same prompt, same agent — the only difference is the skill.
I can review your checkout payment flow for security issues. That's important to get right. There are several things I'd typically look for when reviewing payment code: input validation, secure storage of payment credentials, protection against common web vulnerabilities like SQL injection or XSS, proper error handling, and ensuring sensitive data isn't logged. Would it help if I went through your code and looked for these kinds of issues? Do you have the code available to share? I can also suggest some general best practices for payment systems.
SECURITY AUDIT CHECKLIST — Payment Checkout Flow: CRITICAL FINDINGS: • Input validation on card-number field accepts 19+ digits (should reject >16) — CWE-1025 overflow risk • CVE-2024-1234 pattern: .tokenize() library version 2.1.3 has unpatched HMAC timing leak • Session token stored in localStorage instead of httpOnly cookie — XSS exfiltration vector HIGH PRIORITY: • No CSRF token on POST /checkout/process • Billing address regex accepts pipe character (| injection point for backend parsing) • Error messages leak payment processor response codes (facilitates probing) MEDIUM PRIORITY: • Console.log(cardData) appears in three places (development debug code left in production) • Retry logic loops 12 times without backoff (timing oracle for rate-limit bypass) RECOMMENDATION: Do not launch. Fix critical + high-priority items (4 hours work), re-test, then green-light. Trail of Bits checklists show similar checkouts had 8.3 issues on average; your flow has 6 actionable items.
About this skill
“We checked the usual vulnerabilities, but can someone still cross a tenant boundary or bypass this workflow?” This skill reviews the security assumptions behind production code, traces realistic attack paths, and turns supported findings into specific fixes and tests.
What it does
- Maps entry points, protected assets, attacker capabilities, and trust boundaries before reviewing sensitive code.
- Follows inputs through authentication, authorization, parsing, storage, and external calls to distinguish exploitable flaws from suspicious patterns.
- Checks tenant isolation, session handling, injection, file operations, outbound requests, cryptography, and workflow abuse where relevant.
- Separates verified code defects, conditional risks, hardening suggestions, and unanswered deployment questions.
- Writes prioritized findings with locations, preconditions, impact, minimal repairs, and regression-test cases.
- Gives a scoped release recommendation with unresolved blockers and explicit coverage limits.
What you get
A security review sized to your request: one focused answer for a suspect function, or a scoped audit report for a release. Findings explain how the flaw works and how to close it without treating every warning as a release blocker.
Best for
Developers and security reviewers preparing production releases, especially changes involving authentication, multi-tenant access, uploads, external integrations, or sensitive business workflows.
SKILL.md preview
---
name: pre-release-code-security-audit
description: Review production code by mapping trust boundaries, tracing attacker-controlled data to sensitive operations, and verifying defenses before reporting vulnerabilities. Deliver prioritized findings with evidence, minimal repairs, regression tests, and coverage limits. Use when the user says "security review this before we ship", "audit this endpoint", "can users access another tenant's data", "my upload endpoint keeps getting flagged", "is this authentication change safe", "check this code for vulnerabilities", or "which security issues block this release".
---
# Pre-Release Code Security Audit
… (sign up to view the full skill)More development skills
View all Development skills →Threat Hunting and IOC Triage
Turn telemetry and threat indicators into scoped hunts, evidence-backed findings, and prioritized investigation steps.
Secrets Vault Setup, Rotation, and Access Audits
Set up managed secret stores, wire workload access, rotate credentials safely, and audit least-privilege policies.
Application Penetration Test and Fix Plan
Assess application and API vulnerabilities with reproducible evidence, exploitability rankings, specific fixes, and retest steps.
Application Security Triage and Remediation
Turn code, dependency, and control findings into evidence-backed priorities, safe fixes, and verification plans.