security-review

Security Review Skill

Systematic security audit for code changes. Use during the security pass of /review or when reviewing security-sensitive code.

Checklist

Input Validation

• All user input validated on the backend (frontend validation is UX only)
• Form Requests used for all controller inputs
• $request->validated() used — never $request->all() or $request->only()
• File upload validation: type, size, extension
• JSON/array input has explicit structural validation

Authentication & Authorization

• $this->authorize() called before resource access
• Policy classes used — no inline authorization in controllers
• Sanctum guards applied to protected routes
• No user ID or role spoofing possible via client input
• Rate limiting on auth endpoints (throttle middleware)

Data Exposure

• API Resources filter output — no toArray() dumping full models
• Sensitive fields excluded from responses (passwords, tokens, internal IDs)
• Error responses reveal no internal structure in production
• No secrets in logs, debug output, or error messages

SQL & Query Safety