code-review

Security Code Review

Overview

Review all code changes made during security remediation. Verify that fixes are correct, complete, and don't introduce new issues.

Checklist

• Fix correctness: Does the fix actually resolve the vulnerability? Would the scanner pass on re-scan?
• No regressions: Does the fix break existing functionality? Are existing tests still passing?
• No weakening: Does the fix weaken any existing security control? (e.g., widening permissions to fix a different issue)
• Guidelines compliance: Does the fix follow the merged remediation guidelines?
• Minimal change: Is the fix the minimum necessary? No unnecessary refactoring alongside security fixes.
• Dependency safety: For dependency upgrades, are changelogs checked for breaking changes?
• Lock file updated: Are lock files (package-lock.json, yarn.lock, poetry.lock, go.sum) regenerated?
• Secret hygiene: No secrets, tokens, or credentials in the fix or commit message
• Terraform safety: IaC changes don't increase blast radius (e.g., don't open new ports while closing others)
• Commit format: All commits use fix(security): prefix per write-commit skill