Codebase Security Review
Performs judgment-level security audits to detect unsafe rendering, auth flaws, misconfigured headers, reachable CVEs, and exposed secrets.
The Codebase Security Review skill goes beyond automated CI linters by providing context-aware, judgment-level security audits of your application. Instead of blindly reporting automated scanner warnings, it evaluates unsafe DOM injection patterns (XSS), server-side authorization boundaries and IDOR vulnerabilities, CORS misconfigurations, and environment hygiene. It critically triages npm audit CVEs to determine runtime reachability versus build-time devDependencies, and inspects both legacy Git history and uncommitted working-tree changes for exposed secrets using Semgrep and Gitleaks rules.
Key Features
01Detects exposed secrets across full Git history and uncommitted code
02Audits CORS policies, security headers, and .env repository leakage
03Evaluates authentication boundaries, IDOR risks, and CSRF protection
04Triages npm audit findings to separate real runtime risks from build noise
051 GitHub stars
06Identifies XSS and injection risks in React, Vue, and backend queries
Use Cases
01Pre-release security audits to catch vulnerabilities before merging to production
02Scanning working branches and historical Git commits for hardcoded secrets and tokens
03Triaging automated npm audit and dependency warnings for real-world exploitability