[NEW SKILL] geo-redundant-secret-replication-review

[JeremyZeng77]

Proposed Skill

Skill name: geo-redundant-secret-replication-review
Category: secrets
Severity: high

What It Detects

Cross-region secret replication may expand decryption scope or weaken revocation if replication and residency controls are not explicit.

Why This Skill Is Needed

This topic appears in real security reviews, but it is not represented cleanly in the current library. A dedicated skill would make the review repeatable and easier to apply across products.

Detection Approach

Map the trust boundary, identify where authority is derived, then review validation, provenance, exception handling, replay behavior, and background or operator paths that may get broader reach than intended.

Languages / Frameworks

• secret managers
• multi-region infrastructure

Example Vulnerable Pattern

Authority or access is inferred from a weak context signal,
then reused in a broader path without a fresh authorization check.

Example Remediation

Bind authority to explicit actor and resource context,
re-check it at the sensitive boundary,
and log approval or provenance for privileged paths.

References

• OWASP ASVS
• NIST SP 800-53
• Relevant vendor or protocol guidance for this control family

Estimated Complexity

• Standard ($200) - Well-known vuln class, single language, straightforward detection
• Intermediate ($350) - Multiple languages/frameworks, nuanced detection logic
• Complex ($500) - Novel detection approach, comprehensive coverage, low FP rate

Bounty Info

• I have read and agree to the CONTRIBUTING.md bounty terms
• Preferred payment method: PayPal https://paypal.me/Jeremytsangchina

[weilixiong]

/attempt #2426

I will add the geo-redundant-secret-replication-review skill under the secrets/devsecops area, with concrete checks for cross-region secret replication scope, KMS/key residency, revocation propagation, audit provenance, break-glass paths, and backup/DR copies. I will update the skill index and validate frontmatter/index references before opening the PR.

Requested bounty tier: Intermediate ($350).

[weilixiong]

Submitted PR #2577 for this item: #2577

It adds the geo-redundant-secret-replication-review skill, updates the index, and includes vulnerable/benign fixtures for AWS, GCP, and Vault-style DR replication patterns. Local validation passed for frontmatter, index references, prompt-injection scan, and diff whitespace.