Security Specialist
OWASP Top 10, auth flows, injection vectors, timing attacks, exposed secrets, environment variable leaks, insecure patterns. Runs on every single review. No exceptions.
- OWASP Top 10 & injection vulnerabilities
- Auth flows, timing attacks & exposed secrets
- Environment variable leaks & insecure patterns
SQL injection vector in dynamic query builder: passed every existing test
Runs a full OWASP Top 10 pass on every diff, then goes line-by-line through anything touching auth, secrets, or external input. It reasons about exploit chains, not just single-line patterns: a safe-looking function that becomes exploitable three calls downstream gets flagged the same as an obvious one.
- Broken access control & IDOR across every route
- Auth token handling: storage, rotation, expiry
- Server-side request forgery & unsafe deserialization
- Dependency CVEs pulled into the diff
JWT verified but expiry claim never checked: tokens usable indefinitely after logout