Secure Code Review Skill

Purpose

Establish security-focused code review practices across all Hack23 projects, ensuring security vulnerabilities, insecure patterns, and compliance violations are identified and remediated before code reaches production.

Rules

Review Requirements

MUST:

• Review all code changes for security implications before merging

• Use automated security scanning (CodeQL, Dependabot) as first line of defense

• Check for OWASP Top 10 vulnerabilities in every review

• Verify proper input validation and output encoding

• Confirm no secrets, credentials, or keys in code or configuration

• Validate proper error handling (no information leakage)

• Check authorization controls on new endpoints or resources

• Verify proper use of cryptographic functions

• Review dependency additions for known vulnerabilities

MUST NOT:

• Approve code with known Critical/High vulnerabilities

• Skip security review for "minor" changes (attackers exploit small changes)

• Approve code that disables security controls without documented justification

• Allow self-approval on security-sensitive changes

Security Review Checklist

For every pull request, verify:

Authentication & Authorization:

• Authentication enforced for non-public resources

• Authorization checked at each access point

• Principle of least privilege applied

Input/Output:

• All input validated (allowlist approach)

• Output properly encoded for context

• No raw user input reflected without sanitization

Data Protection:

• Sensitive data encrypted at rest and in transit

• No secrets in source code or configuration files

• Data classification appropriate for handling

Error Handling:

• No stack traces exposed to users

• Errors logged securely (no sensitive data in logs)

• Graceful failure without security bypass

Dependencies:

• New dependencies checked for vulnerabilities

• Dependency versions pinned to specific versions

• No unnecessary dependencies added

Automated Scanning Integration

MUST configure on all repositories:

• GitHub CodeQL analysis on push and PR

• Dependabot alerts enabled

• Secret scanning enabled

• Branch protection requiring status checks to pass

Hack23 ISMS Policy References

• Secure Development Policy

• Information Security Policy

• Change Management

Compliance Mapping

• ISO 27001:2022: A.8.25 (Secure Development Lifecycle), A.8.4 (Access to Source Code)

• NIST CSF 2.0: PR.DS (Data Security), PR.IP (Information Protection)

• CIS Controls v8.1: Control 16 (Application Software Security)