# Review Security Pitfalls in Application Code

Security mistakes often hide in key storage, caches, logs, and environment handling. This skill gives review checklists and safer patterns for those areas.

## Install

```bash
npx skillstore add barissozen/pitfalls-security
```

## Metadata

- Status: approved
- Slug: barissozen-pitfalls-security
- Skillstore revision: r1
- Version status: missing
- Tree hash: 6197e6e44de7ec9ce66531253e55bac6a909e9780aea84de0084431c6fd6fd53
- Author: BarisSozen
- GitHub username: BarisSozen
- License: MIT
- Repository: https://github.com/BarisSozen/claude/tree/main/.claude/skills/pitfalls-security
- Ref: c4231f0153ccd2a2ed62274c5a372bf8f2386d3f
- Supported tools: Claude, Codex, Claude Code
- Audit status: complete
- Agent install advisory: allowed
- Manual install advisory: allowed
- Artifact signature: available
- Audit attestation: unavailable
- Human verification: not\_verified
- Risk factors: external\_commands, env\_access
- Quality score: 78
- Quality tier: bronze
- Public page: https://skillstore.pages.dev/skills/barissozen-pitfalls-security
- Manifest: https://skillstore.pages.dev/api/skills/barissozen-pitfalls-security/manifest

## Capabilities

- Reviews private key storage risks and safer session key patterns.
- Shows frontend and backend environment variable handling guidance.
- Flags unsafe logging of configuration objects and API keys.
- Recommends cache time limits and avoiding sensitive cache entries.
- Provides audit logging examples for sensitive operations.

## Use Cases

- Review Authentication Changes: Check whether session keys have expiry, permissions, and transaction limits before release.
- Harden Logging Practices: Review application logs to avoid leaking secrets, configuration objects, or sensitive user data.
- Prepare Security Checklists: Create practical review steps for caches, environment variables, and audit logs.

## Prompt Templates

### Basic Secret Check

```
Review this change for private key storage, secret logging, and unsafe environment variable use. List the highest priority fixes first.
```

### Cache Safety Review

```
Check this caching design for sensitive data exposure. Identify cache keys, stored values, expiration rules, and user-specific data risks.
```

### Session Key Design Review

```
Evaluate this session key design. Check permissions, expiry, per-transaction limits, encryption, and audit logging coverage.
```

### Release Security Gate

```
Perform a release gate review for key storage, environment variables, logs, caches, and audit events. Return blockers, warnings, and required tests.
```

## Limitations

- It provides guidance only and does not scan repositories automatically.
- It does not replace a formal application security review.
- Examples are TypeScript-focused and may need adaptation for other stacks.
- It cannot validate runtime secret handling without project context.

## Best Practices

- Treat keys, tokens, connection strings, and configuration objects as sensitive by default.
- Use short-lived session keys with explicit permissions, expiration, and transaction limits.
- Log operational context without secrets, and add audit events for sensitive actions.

## Anti Patterns

- Storing private keys in localStorage, plaintext databases, or shared caches.
- Logging full configuration objects, API keys, or database connection strings.
- Caching user-specific sensitive data without strict expiration and isolation.

## Security Audit

- Audited at: 2026-07-06T03:48:12.688\+00:00
- Summary: The static findings are false positives caused by Markdown code fences, TypeScript template literals, and security teaching examples. The skill is documentation-only and consistently warns users not to store private keys, cache secrets, or log sensitive environment values.

## Stats

- Views: 240
- Downloads: 8
- Favorites: 0
- Popularity score: 0