00PrabalK00/security-review-playbook

Security Review Playbook

Overview

Review systems with an attacker and defender mindset at the same time.

Core Workflow

1. Map trust boundaries, data flows, privileged actions, and externally reachable surfaces.
2. Check authentication, authorization, session handling, and access-control assumptions.
3. Inspect input handling, query construction, file access, redirects, deserialization, and unsafe execution paths.
4. Check secrets, logging, configuration defaults, dependency posture, and data exposure risks.
5. Report concrete findings by severity with exploit path, impact, and remediation guidance.

Deliver

• Focus on real vulnerabilities and meaningful hardening gaps.
• Note missing evidence separately from confirmed findings.
• Include operational or product follow-ups when fixes require them.

Guardrails

• Prefer primary evidence from code and config over hypothetical fear lists.
• Avoid exploit-detail overproduction when a safer summary is enough.
• Escalate broken access control, secret leakage, and unsafe defaults quickly.