How do I check security?
Understand the concept
A security review checks whether code respects boundaries between untrusted input, authenticated identity and protected actions or data. It asks what a caller can control and whether that control lets them exceed their permissions. Framework defaults and type annotations do not establish resource-level access automatically.
Important ideas
-
Check input validation, authentication, resource ownership and tenant filters.
-
Check bound query parameters and safe handling of secrets and tokens.
-
Verify that a normal user cannot call an admin operation directly.
-
Follow user-controlled IDs into queries and verify that ownership or tenant conditions are applied where the data is accessed.
Can you explain it without the notes?
How do I check security?
Use your own words. Explain an example and one limitation before checking the explanation.
Check your explanation
A security review checks whether code respects boundaries between untrusted input, authenticated identity and protected actions or data. It asks what a caller can control and whether that control lets them exceed their permissions. Framework defaults and type annotations do not establish resource-level access automatically.
Turn this concept into a clear answer.
- Give an abuse case and a targeted control; a generic “validate input” comment does not explain the vulnerability.
Adapted from 11_AI_CODE_REVIEW.md · “How do I check security?”. Examples are study fragments; framework behavior can depend on your version.