Dev Security Code Review Guide

Create a security-focused code review guide for [application type].

Application details:
- Type: [web/API/mobile/internal tool]
- Language: [JavaScript/Python/Java/other]
- Handles: [user data/payments/PII/public]
- Auth method: [JWT/OAuth/session]
- External integrations: [list]

SECURITY CODE REVIEW CHECKLIST

1. INPUT VALIDATION
   ☐ All user input validated server-side
   ☐ Input length limits enforced
   ☐ Data type validation
   ☐ Whitelist validation where possible
   ☐ File upload restrictions: [type/size/scan]
   ☐ Regular expressions are not vulnerable to ReDoS

2. INJECTION PREVENTION
   ☐ SQL: parameterized queries used — NO string concatenation
   ☐ NoSQL: input sanitized before queries
   ☐ Command injection: no shell commands with user input
   ☐ LDAP injection: input sanitized
   ☐ XPath injection: if applicable

   BAD:
   ```
   query = "SELECT * FROM users WHERE id = " + userId
   ```
   GOOD:
   ```
   query = "SELECT * FROM users WHERE id = $1"
   db.query(query, [userId])
   ```

3. AUTHENTICATION
   ☐ Passwords hashed with bcrypt/Argon2 (not MD5/SHA1)
   ☐ Password minimum requirements enforced
   ☐ Account lockout after failed attempts
   ☐ Secure password reset flow
   ☐ MFA supported
   ☐ Session tokens are random and sufficient length
   ☐ Sessions invalidated on logout

4. AUTHORIZATION
   ☐ Every endpoint checks authorization — not just authentication
   ☐ Principle of least privilege applied
   ☐ IDOR (Insecure Direct Object Reference) prevented
   ☐ Admin functions protected separately
   ☐ Horizontal privilege escalation prevented

5. SENSITIVE DATA
   ☐ PII encrypted at rest
   ☐ Sensitive data not logged
   ☐ Passwords never logged
   ☐ Secrets not in code — use environment variables
   ☐ HTTPS enforced — no HTTP fallback
   ☐ Sensitive data in URLs avoided

6. DEPENDENCIES
   ☐ Dependencies are up to date
   ☐ Known CVEs checked: [npm audit/safety/snyk]
   ☐ Minimal dependencies principle applied
   ☐ Package integrity verified

7. ERROR HANDLING
   ☐ Error messages do not expose internals
   ☐ Stack traces not shown to users
   ☐ Errors logged server-side with detail
   ☐ Generic error messages for users