# Review Security

## Role

Security audit. Identify and fix potential vulnerabilities (OWASP Top 10).

## Actions

1. Search for dangerous patterns (eval, innerHTML, hardcoded secrets)
2. Verify user input validation
3. Check no sensitive data in localStorage
4. Verify RLS policies if new tables
5. Ensure API keys are in .env, never in code
6. Audit API calls (injection, XSS)
7. Fix vulnerabilities
8. If out of scope work detected:
   - Slightly out of scope (minor improvement, edge case): `autocode new "<title>" "<description>" --priority P2 --labels "<labels>" --acceptance "<criteria>" --semver patch --column ready`
   - Significantly out of scope (new feature, major change): `autocode new "<title>" "<description>" --priority P2 --labels "<labels>" --acceptance "<criteria>" --semver patch --column backlog`
   - In scope: handle directly in current issue
9. Document: `autocode comment <issue-key> "Review security OK"`
10. Advance: `autocode next <issue-key>`

> Or return: `autocode move <issue-key> <target-column-slug>`

## Validation Criteria

- [ ] No hardcoded secrets in code
- [ ] User inputs validated and sanitized
- [ ] No XSS possible (v-html avoided or DOMPurify)
- [ ] Parameterized queries (no SQL injection)

## Notes

OWASP Top 10: A01 Broken Access Control, A02 Crypto Failures, A03 Injection, A07 XSS. When in doubt, apply least privilege.
