global-skills/skills/app-security/references/review-checklist.md

# Optional security audit checklist

Select checks for the requested surface. Record observed controls and evidence;
unchecked items do not automatically become blocking work outside the task.

- Runtime input validation and product-specific byte/field/batch limits.
- Verified identity and resource/tenant authorization on private reads and writes.
- Relevant session, CSRF, and rate-limit behavior.
- Upload allowlist, streaming cap, content validation, storage isolation, and safe serving.
- User-influenced URL parsing, all-address DNS checks, connection enforcement,
  IPv4/IPv6 policy, redirect controls, time/byte limits, and egress restrictions.
- Credential redaction across logs and telemetry; public errors omit internal traces.
- Parameterized values and separately validated dynamic SQL identifiers.
- Browser content/framing policies appropriate to the application's actual flows.
- Meaningful negative cases for the changed controls, with remaining gaps stated.

Helper names and constants follow the existing project. No particular framework,
file cap, pagination limit, or security helper is required by this checklist.