feat: refresh shared skills catalog

skills/app-security/references/review-checklist.md

@@ -1,30 +1,18 @@
-# Security Review & OWASP Verification Checklist
+# Optional security audit checklist
 
-## Input Validation & Boundaries
-- [ ] Pydantic schemas enforce hard string bounds (max 50,000 for text, max 200 for titles).
-- [ ] Dynamic path/query identifiers validated via `sanitize_identifier()`.
-- [ ] Pagination limits clamped to `1 <= limit <= 50`.
-- [ ] Batch array inputs clamped to safe upper bounds (max 100–200 items).
+Select checks for the requested surface. Record observed controls and evidence;
+unchecked items do not automatically become blocking work outside the task.
 
-## Four-Pillar Upload Defense
-- [ ] Uploads restricted by `DEFAULT_MAX_FILE_SIZE` (100MB; 5MB for images).
-- [ ] Blocked executable extensions rejected (`BLOCKED_EXTENSIONS`).
-- [ ] Extension checked against `ALLOWED_EXTENSIONS`.
-- [ ] Header magic bytes inspected (`check_magic_bytes`) to block disguised binaries.
-- [ ] Filenames sanitized with `sanitize_filename()` (path traversal and CLI injection stripped).
-- [ ] Disk writes resolved strictly via `safe_resolve_path()`.
+- Runtime input validation and product-specific byte/field/batch limits.
+- Verified identity and resource/tenant authorization on private reads and writes.
+- Relevant session, CSRF, and rate-limit behavior.
+- Upload allowlist, streaming cap, content validation, storage isolation, and safe serving.
+- User-influenced URL parsing, all-address DNS checks, connection enforcement,
+  IPv4/IPv6 policy, redirect controls, time/byte limits, and egress restrictions.
+- Credential redaction across logs and telemetry; public errors omit internal traces.
+- Parameterized values and separately validated dynamic SQL identifiers.
+- Browser content/framing policies appropriate to the application's actual flows.
+- Meaningful negative cases for the changed controls, with remaining gaps stated.
 
-## SSRF Defense
-- [ ] All outbound requests in research/web-retrieval validated with `validate_safe_url()`.
-- [ ] Loopback (`127.0.0.1`), private RFC 1918 subnets, and cloud metadata (`169.254.169.254`) blocked.
-- [ ] Scheme restricted strictly to `http` and `https`.
-
-## Secrets & Data Hygiene
-- [ ] Zero API keys, bearer tokens, or password hashes written to `error_log` or logs.
-- [ ] Authorization headers masked in logging formatters (`Bearer ***`).
-- [ ] Production error responses mask internal database paths and raw tracebacks.
-
-## Authorization & State Safety
-- [ ] Mutations verify that target records match the active session / conversation scope.
-- [ ] SQLite queries use parameterized SQL; no raw string concatenation.
-- [ ] Rate limits applied on expensive inference and digestion endpoints.
+Helper names and constants follow the existing project. No particular framework,
+file cap, pagination limit, or security helper is required by this checklist.