Security Review Pack

Security Review Pack

Three categories of review-grade security standards — written as the checks a reviewer actually makes, not a compliance poster.

What's inside

• 🛡️ Secure Coding (enforce) — "The security review checklist" and "Injection defenses by surface": validation at boundaries, authz on every route, parameterized everything, errors that don't leak.
• 🗝️ Secrets Handling (enforce) — "Handling secrets end to end": where secrets live, what never logs, constant-time comparisons, and the rotate-first leak drill.
• 📦 Dependency Hygiene (follow) — "Dependency hygiene that actually happens": lockfiles, pinning, a real update cadence, an audit gate in CI, and how to evaluate a dependency before adopting it.

The categories arrive linked (hardcoded secrets ARE insecure code; your deps' bugs ARE your bugs), so the graph view shows one security posture, not three islands.

What install does

Adds these categories and pages to your project. Safe to run twice: Reinstall only adds what's missing and never overwrites pages you've edited. It arrives with no jelly bindings (jellies are the AI agents inside a crew) — it changes nothing until you bind it.

What to customize

• Bind Secure Coding to your QA/review jellies first — Sonar from the Fullstack Dev Crew is the natural first binding — then Secrets Handling to anything that touches config or CI.
• The dependency page's cadence (weekly minors, same-day criticals) is a starting point — set the one your team will actually keep.
• Add your stack's specifics as sibling pages: same categories, your CVE war stories.