review-security

Use this skill when reviewing Hanami 2.x code for security concerns.

Core principle: Security is layered. Validate at the boundary, authenticate explicitly, and never trust input.

---

Review Workflow

Follow this sequence when performing a security review. For each step, the Red Flag column indicates a failing condition; if a red flag is found, apply the remediation noted in Core Rules below.

Completion Checkpoint

After completing all steps, compile findings into a summary:

• Critical — Must be fixed before merge; these are exploitable vulnerabilities (SQL injection, missing auth, hardcoded secrets, missing CSRF, direct param use, XSS).
• High — Should be fixed soon; meaningful risk but harder to exploit directly (missing authz, sensitive logging, insecure session config).
• Advisory — Best-practice improvements with lower immediate risk (generic error messages, structural hardening).

For each finding, report: location (file + line), severity, a summary of the issue (never include actual secret values, passwords, tokens, or API keys — describe their presence without exposing them), and the recommended fix (see Core Rules).

---

Core Rules

Detailed remediation patterns for each finding category.

1. Validate all params via the Params DSL:

   # GOOD
   params do
     required(:email).value(:string, format?: /\A.+@.+\z/)
     required(:password).value(:string, min_size?: 8)
   end
   
   # BAD
   user_repo.create(request.params)

2. Enable CSRF protection for HTML endpoints:

   # config/app.rb
   config.actions.csrf_protection = true

3. Authenticate in Actions using injected services:

   include Deps["authentication"]
   before :authenticate!
   
   def authenticate!(request, response)
     halt 401 unless authentication.valid?(request)
   end

4. Never log sensitive data:

   # GOOD
   logger.info("Login attempt: #{params[:email]}")
   # BAD: logger.info("Login: #{params[:email]}, password: #{params[:password]}")

5. Store secrets in settings, never in code:

   # config/settings.rb
   setting :session_secret, constructor: Types::String

   # .env
   SESSION_SECRET=your-secret-here

6. Prevent SQL injection using ROM's query interface:

   # GOOD: users.where(email: params[:email]).one
   # BAD:  users.where("email = '#{params[:email]}'").one

7. Escape output in templates — ERB auto-escapes by default; never use raw on user input:

   <!-- GOOD -->
   <p><%= user.bio %></p>

8. Use secure session configuration:

   config.sessions = :cookie, {
     key: "my_app.session",
     secret: settings.session_secret,
     expire_after: 60 * 60 * 24 * 7
   }

9. Return generic error messages for auth failures:

   # GOOD: halt 401, { error: "Invalid credentials" }.to_json
   # BAD:  halt 401, { error: "User not found" }.to_json

---

Integration