Security Review: Evidence at Trust Boundaries

What it does

ECC’s security review source organizes checks around secrets, input validation, database access, authentication, authorization and browser security. It also covers file uploads, CSRF, throttling, dependency hygiene and sensitive logging. The useful output is an evidence-backed finding with a reachable boundary and an actionable fix, not a checklist marked safe because a scanner returned no warnings. Several snippets are framework-specific and need review: the sample content security policy permits inline script and eval, and file extension or MIME checks alone do not establish that an uploaded file is safe.

When to use it

• Review a new endpoint that returns account-specific documents.
• Assess an upload feature before accepting untrusted files.
• Check whether logs or exception handling expose credentials during failed authentication.

Step-by-step workflow

1. Identify assets, callers, privileges and untrusted inputs; choose the changed paths and a safe test environment.
2. Trace authentication separately from object-level authorization, then inspect queries and server-side validation at each boundary.
3. Review secret storage, logs, file handling, browser controls and dependencies using the actual deployment configuration.
4. Validate likely findings with bounded negative cases; never use production customer data or destructive exploitation.
5. Prioritize by exploitability and impact, patch the reachable issue and record residual risk and controls that were not tested.

Example request

Review the document-download and upload changes in this branch. Treat filenames, document IDs and ownership fields as untrusted. Prove that account A cannot download account B’s file, inspect parameterized queries and verify that error responses and logs redact tokens. Evaluate storage isolation and content validation rather than relying only on filename extensions. Review the deployed CSP before suggesting changes; do not copy permissive examples. Use synthetic files and accounts. Return findings with file locations, reproduction conditions, fixes and explicit untested areas.

Worked example

An authenticated download route may correctly validate a session yet fetch a document solely by its numeric ID. The review uses two synthetic accounts and a known foreign document ID to test authorization independently of login. The repair scopes the lookup to the authorized owner and preserves a non-revealing failure response. A regression check exercises both the legitimate download and foreign access. Separately, an upload test shows why a renamed executable passing an extension check is insufficient; the final policy must consider content, storage location and how files are served.

What you get

A prioritized finding list, minimal remediations, bounded regression evidence and an explicit statement of scope and unresolved controls.

How to evaluate the result

• Each serious finding has a reachable path and safe reproduction.
• The fix rejects unauthorized access while preserving the legitimate use case.
• Reports and diagnostic artifacts contain no credentials or private payloads.

What you need

Code and deployment configuration, synthetic accounts, permission to test the selected environment and access to dependency manifests. Secrets remain outside prompts and reports.

Setup and activation

The reviewed ECC source provides an .agents skill layout. Consult the repository README for the chosen client, retain referenced supporting files and explicitly activate only the workflow needed. This catalogue read source files; it installed and executed nothing. Client compatibility depends on available tools and instruction loading, and was not runtime-tested here. Before installation, scan the exact source version, review permissions and use disposable non-sensitive examples.

Limits and considerations

This source is guidance, not a penetration-test certificate or compliance opinion. Automatic dependency fixes can introduce incompatible changes. A permissive CSP, client-only validation or authenticated session does not establish authorization or protection against malicious uploads.

Related workflows

• Use Backend Patterns to repair transaction and data-access boundaries.
• Use Verification Loop to report what security checks actually ran.

License and reuse

MIT in the selected SKILL.md and repository LICENSE. Preserve notices; external packages, services and example dependencies retain their own terms.

Further reading

• Reviewed skill at immutable commit
• Reviewed publisher README
• Reviewed MIT license