Exposure paths reviewed is handled by this skill in a customer-readable, reusable workflow.
Secret handling checked is handled by this skill in a customer-readable, reusable workflow.
SB_security_assessment@SB_security_assessmentVerification & QAIncluded in bundle10 minutes
What is this?
Security becomes real when the product handles logins, admin actions, payments, downloads, customer files, private data, or secret keys. Security Assessment is a defensive review skill: it maps the sensitive entry points, separates verified findings from assumptions, explains risks in plain language, and orders safe fixes. It does not claim the product is secure; it gives the owner a clearer view of what must be checked before real users or money depend on the system.
When this helps
What you get
- Security risk review
- Exposure notes
- Fix priorities
- Verification checklist
Use it when
- The product now includes login, payments, downloads, admin actions, customer data, or anything that should not be publicly exposed.
- You are preparing to let others use the product, but do not know whether admin access, files, keys, or payment flows are accidentally exposed.
- You need security risks explained in plain product language with clear fix priorities, not a technical audit you cannot act on.
Not the right fit when
- It is not a penetration test and does not prove the system is secure. It is a defensive starter assessment.
What this prepares next
Clearer launch risk -> Safer remediation plan -> Less blind trust
Why this is stronger than asking AI once
A quick 'is this secure?' prompt can miss the places where real product risk enters: secrets, admin access, payments, downloads, webhooks, and exposed data. Security Assessment is stronger because it maps defensive risk areas, records exposure notes, and ranks remediation priorities the owner can act on. The buyer gets a clearer launch-risk picture instead of a generic security opinion. Boundary: It is not a penetration test and does not prove the system is secure; it is a defensive starter assessment.
Included interface patterns
Threat Surface Map
A plain-English map of entry points, assets, and trust boundaries.
Sensitive-flow review scope and missing-evidence list.Security Code Review
A defensive file or route review for secrets, auth, payment, download, and logging risks.
Evidence-based findings with severity and safe remediation.Remediation Plan
A safe fix order that avoids weakening existing controls.
Patch notes, verification steps, and `@SB_clean_code` handoff.