Conducts comprehensive security audits including threat modeling, vulnerability assessment, and remediation guidance.
shawnpang-startup-founder-skills-skills-security-review/SKILL.md
---
name: security-review
description: When the user needs a security assessment - threat modeling, vulnerability review, auth flow audit, dependency scanning, or says "is this secure", "review for vulnerabilities", "threat model", "security audit", "pen test prep".
related: [code-review, architecture-design, soc2-prep]
reads: [startup-context]
---
# Security Review
## When to Use
- The user wants a security audit of their application, infrastructure, or specific feature
- They need a threat model before launching or a penetration test preparation review
- They have a dependency vulnerability alert and need remediation guidance
- They are handling sensitive data (PII, payment, health) and need verification
- Code audit, secrets detection, or compliance assessment is requested
## Context Required
From `startup-context`: tech stack, deployment environment, compliance requirements, data types. Also ask:
- **Scope** - Full app, feature, auth system, single PR, infrastructure, or cloud environment
- **Data types** - PII, payment, health, credentials, or other sensitive data handled
- **Compliance requirements** - SOC 2, HIPAA, PCI-DSS, GDPR, ISO 27001
- **Authorization** - Confirm written authorization exists before any active testing
## Workflow
Follow a five-phase methodology. Automated scanning precedes manual review. Authorization verification is mandatory before active testing.… load the full skill through Skill Me