Secure Your Code with Automated Security Reviews

Provides a security review checklist and code patterns across ten categories for TypeScript/Next.js/Supabase applications: secrets management (env vars, never hardcoded), input validation (Zod schemas, file-upload size/type/extension checks), SQL injection prevention (parameterized queries over string concatenation), authentication and authorization (httpOnly cookies instead of localStorage, role checks before sensitive operations, Supabase Row Level Security policies), XSS prevention (DOMPurify sanitization, Content-Security-Policy headers), CSRF protection (tokens and SameSite=Strict cookies), rate limiting (express-rate-limit with stricter windows on expensive routes like search), sensitive-data-exposure prevention (redacting secrets from logs, generic error messages to users), Solana blockchain security (wallet-signature verification, transaction amount/balance/recipient checks), and dependency security (npm audit, committed lock files, npm ci in CI). Each category pairs a "never do this / always do this" code contrast with its own verification checklist, and the guide closes with a security-testing example suite and a full pre-deployment checklist.

# Check for vulnerabilities
npm audit

# Fix automatically fixable issues
npm audit fix

# Update dependencies
npm update

# Check for outdated packages
npm outdated

Run this review when implementing authentication or authorization, handling user input or file uploads, creating new API endpoints, working with secrets or credentials, implementing payment features, storing or transmitting sensitive data, or integrating third-party APIs. It is not a security scanner or automated tool - it is a manual checklist and set of code patterns to apply by hand, and its examples assume a specific stack (Next.js, Supabase, Zod, DOMPurify, express-rate-limit, and Solana's web3.js for blockchain features); teams outside that stack get the checklist items but must translate the code.

There is no API to call - the skill is a set of before/after code contrasts and checkbox lists, organized per category. For example, "Secrets Management" pairs a hardcoded-token anti-example with a process.env version and a five-item verification checklist. The security-testing section gives runnable test-suite examples asserting expected HTTP status codes: 401 for missing auth, 403 for missing admin role, 400 for invalid input, and 429 once a rate limit is exceeded. The guide ends with a 17-item pre-deployment checklist spanning secrets, input validation, SQL injection, XSS, CSRF, auth, rate limiting, HTTPS, security headers, error handling, logging, dependencies, Row Level Security, CORS, file uploads, and wallet signatures.

Code examples reference Supabase (parameterized queries, Row Level Security policies), Zod for schema validation, DOMPurify for HTML sanitization, express-rate-limit for API throttling, @solana/web3.js for wallet and transaction verification, and standard Next.js API route/response conventions.

Developers on a Next.js/Supabase/TypeScript stack, with optional Solana blockchain features, who want a concrete, checklist-driven security pass before shipping auth, user-input handling, payments, or new API endpoints - not an automated vulnerability scanner.