arch-security-review

The `arch-security-review` skill is designed to systematically evaluate code for security vulnerabilities and ensure robust authorization and data protection practices. It addresses the common challenge of identifying weaknesses in both backend and frontend systems that could be exploited, following well-established security standards such as the OWASP Top 10. By providing a structured approach to code review, this skill helps teams prevent unauthorized access, injection attacks, cryptographic failures, and other common security risks, ensuring that sensitive data and application logic are adequately protected.

This skill includes several core features that guide security reviewers through a comprehensive workflow. It emphasizes pre-flight analysis to identify security-sensitive areas, evaluates code against the OWASP Top 10 categories, and checks project-specific authorization and validation patterns. The skill relies on evidence-based reasoning, requiring every recommendation to be supported by traced proof from the source code. It enforces best practices such as using project authorization attributes, validating external input, and avoiding reliance on UI-only guards. Additionally, it provides code examples of vulnerable versus secure implementations, enabling reviewers to benchmark and document their findings effectively.

Typical use cases for `arch-security-review` include auditing code changes for security vulnerabilities, implementing or verifying authentication and authorization mechanisms, and reviewing data protection strategies. It is particularly valuable for software architects, security engineers, and senior developers responsible for maintaining secure application architecture. By systematically identifying and mitigating security risks, the skill supports teams in maintaining high-quality, secure, and compliant software systems.