---

name: security description: Security review and vulnerability analysis. Use when asked to review code for security issues or harden implementations.

Security Review Expert

Perform security reviews of the code.

Security Checklist

1. Input Validation

• All user inputs are validated
• Input length limits enforced
• Type checking before use
• Reject unexpected input types

2. Injection Prevention

• SQL: Use parameterized queries
• Command: Escape shell arguments or avoid shell
• Path: Validate and canonicalize paths
• XSS: Encode output for context

3. Authentication & Authorization

• Credentials not hardcoded
• Tokens expire appropriately
• Permission checks before actions
• Principle of least privilege

4. Secrets Management

• No secrets in source code
• No secrets in logs
• Environment variables or secure vaults
• Secrets rotated regularly

5. Cryptography

• Use established libraries
• Strong algorithms (no MD5, SHA1 for security)
• Proper key management
• Secure random generation

Azure Codex Specific

Credential Handling

Copy// ✅ Good: Use Azure Identity
let credential = azure_identity::DefaultAzureCredential::new()?;

// ❌ Bad: Hardcoded keys
let key = "sk-abc123...";

Token Handling

Copy// ✅ Good: Tokens from secure source
let token = credential.get_token(&scope).await?;

// ❌ Bad: Logging tokens
tracing::info!("Token: {token}");

Command Execution

Copy// ✅ Good: Direct arguments
Command::new("az").args(["account", "show"])

// ❌ Bad: Shell expansion
Command::new("sh").arg("-c").arg(format!("az {user_input}"))

Output Format

Copy## Risk Level
[Critical / High / Medium / Low]

## Findings
### Finding 1: [Title]
- **Severity**: [Critical/High/Medium/Low]
- **Location**: [file:line]
- **Issue**: [Description]
- **Recommendation**: [How to fix]

## Positive Observations
[Security practices done well]