How do I check security?

Short explanation:

A security review checks whether code respects boundaries between untrusted input, authenticated identity and protected actions or data. It asks what a caller can control and whether that control lets them exceed their permissions. Framework defaults and type annotations do not establish resource-level access automatically.

Key points:

• Check input validation, authentication, resource ownership and tenant filters.

• Check bound query parameters and safe handling of secrets and tokens.

• Verify that a normal user cannot call an admin operation directly.

• Follow user-controlled IDs into queries and verify that ownership or tenant conditions are applied where the data is accessed.

Interview point:

• Give an abuse case and a targeted control; a generic “validate input” comment does not explain the vulnerability.