security-review

🧠 Gemini-Bridge — Security Analysis

```

mcp_gemini-bridge_consult_gemini(query="Security audit this code for OWASP vulnerabilities: [code snippet]", directory=".")

```

🌉 Open-Bridge — Alternative Security Analysis

```

mcp_open-bridge_consult_gemini(query="Security audit this code for OWASP vulnerabilities: [code snippet]", directory=".")

```

💻 Codex-Bridge — Code Security Review

```

mcp_codex-bridge_consult_codex(query="Find security vulnerabilities in: [code]", directory=".")

```

📚 Context7 (Memory) — Up-to-Date Docs

Lookup security patterns and vulnerability mitigations:

```

mcp_context7_resolve-library-id(libraryName="laravel", query="csrf protection")

mcp_context7_query-docs(libraryId="/laravel/docs", query="authentication security")

```

🌐 Web Search — CVE and Vulnerability Lookup

```

mcp_web-search-prime_search(query="[package name] CVE vulnerability 2025")

```

Every security review MUST run these dependency checks:

```bash

composer audit # Check PHP vulnerabilities

npm audit # Check JS vulnerabilities

php artisan route:list --compact # Verify route middleware

```

Report any vulnerabilities found as Critical findings.

1. Run git diff to identify changed files
2. Scan for security vulnerabilities using checklist below
3. Check authentication and authorization patterns
4. Review input validation and sanitization
5. Report findings by severity (Critical → Warning → Suggestion)

| # | Vulnerability | Laravel Check | React Check |

|---|---------------|---------------|-------------|

| A01 | Broken Access Control | Policies, Gates | Route guards |

| A02 | Cryptographic Failures | Hash::make, encrypt | No secrets in client |

| A03 | Injection | Eloquent, query builder | No dangerouslySetInnerHTML |

| A04 | Insecure Design | Business logic review | Component security |

| A05 | Security Misconfiguration | .env settings | Build config |

| A06 | Vulnerable Components | composer audit | npm audit |

| A07 | Auth Failures | Rate limiting, sessions | Token handling |

| A08 | Data Integrity | CSRF, mass assignment | Form validation |

| A09 | Logging Failures | Security event logs | Error boundaries |

| A10 | SSRF | URL validation | API call validation |

```php

// Mass Assignment

$fillable = ['name', 'email']; // ✅ Whitelist

$guarded = ['id', 'is_admin']; // ✅ Blacklist

// SQL Injection Prevention

User::where('email', $email)->first(); // ✅ Safe

DB::raw("SELECT * FROM users WHERE email = '$email'"); // ❌ Dangerous

// CSRF

@csrf // ✅ In forms

```

```tsx

// XSS Prevention