review-security

Use this skill when reviewing Hanami 2.x code for security concerns.

Core principle: Security is layered. Validate at the boundary, authenticate explicitly, and never trust input.

---

Review Workflow

Follow this sequence when performing a security review:

1. Validate params — Check every Action for a params block. Grep: grep -rn 'request.params' app/actions/ | grep -v 'params do'
2. Verify CSRF config — Confirm config.actions.csrf_protection = true in config/app.rb for HTML apps.
3. Audit auth checks — Confirm every sensitive Action has an explicit before :authenticate! or equivalent. Grep: grep -rn 'def handle' app/actions/ and cross-check with grep -rn 'authenticate'
4. Check authorization — Confirm role/permission checks exist in Actions or service objects beyond mere authentication.
5. Scan for secrets in code — Grep: grep -rn 'secret\|password\|api_key\|token' app/ config/ --include='*.rb' | grep -v 'settings\|ENV'
6. Check logging — Grep: grep -rn 'logger' app/ | grep 'password\|token\|secret'
7. Check SQL safety — Grep: grep -rn 'where("' app/ to find potential string interpolation in queries.
8. Check template output — Grep: grep -rn 'raw ' app/ to find unescaped output.
9. Review session config — Confirm config.sessions has a secret from settings, not hardcoded.
10. Review error messages — Confirm auth failures return generic messages (no user enumeration).

---

Quick Reference Checklist

---

Core Rules

1. Validate all params via the Params DSL:

   # GOOD
   params do
     required(:email).value(:string, format?: /\A.+@.+\z/)
     required(:password).value(:string, min_size?: 8)
   end
   
   # BAD — mass assignment risk
   user_repo.create(request.params)

2. Enable CSRF protection for HTML endpoints:

   # config/app.rb
   config.actions.csrf_protection = true

3. Authenticate in Actions using injected services:

   include Deps["authentication"]
   before :authenticate!
   
   def authenticate!(request, response)
     halt 401 unless authentication.valid?(request)
   end

4. Never log sensitive data:

   # GOOD
   logger.info("Login attempt: #{params[:email]}")
   
   # BAD
   logger.info("Login: #{params[:email]}, password: #{params[:password]}")

5. Store secrets in settings, never in code:

   # config/settings.rb
   setting :session_secret, constructor: Types::String

   # .env
   SESSION_SECRET=your-secret-here

6. Prevent SQL injection using ROM's query interface:

   # GOOD
   users.where(email: params[:email]).one
   
   # BAD
   users.where("email = '#{params[:email]}'")

7. Escape output in templates to prevent XSS:

   <!-- GOOD -->
   <p><%= user.bio %></p>
   
   <!-- BAD -->
   <p><%= raw user.bio %></p>

8. Use secure session configuration:

   config.sessions = :cookie, {
     key: "my_app.session",
     secret: settings.session_secret,
     expire_after: 60 * 60 * 24 * 7
   }

9. Return generic error messages for auth failures:

   # GOOD
   halt 401, { error: "Invalid credentials" }.to_json
   
   # BAD — reveals account existence
   halt 401, { error: "User not found" }.to_json

---

Integration

---

Rails → Hanami