|
3 | 3 | - Comments should be provided in Japanese by default, while maintaining English-based technical analysis to ensure review quality. |
4 | 4 | - When you find a problem, suggest a solution. |
5 | 5 | - If you find a problem that is not in the code, point it out. |
| 6 | + |
| 7 | +## Security review |
| 8 | + |
6 | 9 | - Always evaluate security implications of code changes. |
7 | 10 | - Check for potential vulnerabilities and secure coding practices. |
8 | | -- Check for hardcoded credentials, API keys, and sensitive data |
9 | 11 | - Verify no hardcoded credentials or secrets |
10 | 12 | - Ensure proper input validation and sanitization |
11 | 13 | - Check dependencies for known vulnerabilities |
12 | | -- Verify proper input validation and sanitization |
13 | | -- Ensure secure communication protocols (HTTPS, TLS) |
14 | | -- Review permission and access control implementations |
15 | | -- Check for proper error handling of security-related operations |
16 | | -- Validate secure storage of sensitive data |
17 | | -- Check for proper WebView configuration. |
18 | | -- Secure data storage using Android Keystore, and safe handling of Intent data. |
19 | | -- Since this is a Device Flow client, please verify OAuth 2.0 Device Flow-specific security considerations. |
20 | | - - Ensure that proper PKCE implementation is in place |
21 | | - - Ensure that secure token handling is implemented |
22 | | - - Ensure that state verification is performed |
23 | | - - Verify secure random number generation for state and PKCE values |
24 | | - - Check for proper timing attack mitigations in token comparisons |
| 14 | + - Use GitHub Dependabot alerts and `pnpm audit` |
0 commit comments