security-audit

name security-audit description Proactive security audit: OWASP top 10, dependency vulnerabilities, secrets detection, input validation, auth patterns, and secure defaults. MUST BE USED when user mentions: "security", "vulnerability", "audit", "OWASP", "CVE", "security review", "pentest", "injection", "XSS", "CSRF", "authentication", "authorization", "secrets", "hardcoded password", "secure", "npm audit", "pip-audit", "check security", "is this secure", "security risk", "data leak", "SQL injection", "command injection", "path traversal", "SSRF", "RCE", "privilege escalation", "supply chain", "dependency scan", "snyk", "trivy", "semgrep", "bandit". Scans code for vulnerabilities, checks dependencies, verifies auth patterns. NOT for explaining security concepts (use pedagogical-explain), or general code review (use code-review). allowed-tools ["Read","Grep","Glob","Bash","WebSearch","WebFetch","Agent"] Security Audit Overview Systematic security review covering OWASP Top 10, dependency vulnerabilities, secrets, and secure patterns. Process Phase 1: SCAN -> Automated scans (deps, secrets, patterns) Phase 2: ANALYZE -> Manual review of high-risk areas Phase 3: CLASSIFY -> Rate findings by severity Phase 4: RECOMMEND -> Propose fixes with priority Phase 1: Automated Scans Dependency Vulnerabilities # JavaScript/TypeScript npm audit # Python uv run pip-audit # Rust cargo audit Secrets Detection Search for hardcoded secrets using Grep: Patterns to search for: - API keys: long alphanumeric strings in config files - Credentials: password/token/secret assignments with literal values - Cloud provider keys: AWS access key patterns (starts with AKIA) - Private key headers: PEM format key blocks - Connection strings: database URIs containing embedded credentials - .env files: verify .env is listed in .gitignore Use Grep tool to search for these patterns across the codebase. Focus on: Configuration files ( .config. , *.yml, *.yaml, *.json, *.toml) Source code with string assignments to variables named key, secret, token, password Environment variable files that should NOT be committed Dangerous Code Patterns Search with Grep for: Pattern Risk What to Search eval/exec Code injection eval( , exec( , Function( SQL concatenation SQL injection String concatenation in SQL queries Shell execution Command injection subprocess.call , os.system , child_process.exec Unsafe HTML XSS dangerouslySetInnerHTML , innerHTML = , v-html Unsafe deserialization RCE pickle.load , yaml.load without SafeLoader Open redirect Phishing Redirects using user-controlled input Path traversal File access ../ patterns in user-controlled paths Phase 2: Manual Review OWASP Top 10 Checklist # Vulnerability What to Check A01 Broken Access Control Auth middleware on all routes, RBAC, CORS A02 Cryptographic Failures TLS, proper password hashing (bcrypt/argon2), no weak hashing for passwords A03 Injection SQL parameterized queries, XSS escaping, command injection A04 Insecure Design Business logic flaws, missing rate limiting A05 Security Misconfiguration Default credentials, verbose errors in prod, CORS wildcard A06 Vulnerable Components Outdated deps, known CVEs A07 Auth Failures Session management, brute force protection, MFA A08 Data Integrity Unsigned updates, CI/CD pipeline security A09 Logging Failures Missing audit logs, PII in logs A10 SSRF Unvalidated URLs, internal network access Authentication Review Check: - Password storage -> bcrypt/argon2 (NOT md5/sha1/sha256) - Session management -> Secure, HttpOnly, SameSite cookies - JWT -> Algorithm validation, expiry, refresh tokens - Rate limiting -> Login attempts, API endpoints - CORS -> Not wildcard for authenticated routes - CSRF -> Tokens on state-changing operations Input Validation Review Check: - User inputs -> Validated and sanitized at entry - File uploads -> Type validation, size limits, no path traversal - API parameters -> Schema validation (zod, pydantic, joi) - Database queries -> Parameterized, no string concatenation - Redirects -> Whitelist-only destinations Phase 3: Classify Findings Severity Criteria Action CRITICAL Remote code execution, auth bypass, data leak Fix immediately HIGH XSS, SQL injection, broken access control Fix before deploy MEDIUM Missing headers, weak validation, info disclosure Fix soon LOW Best practice violations, minor misconfigs Plan fix INFO Suggestions, hardening opportunities Optional Phase 4: Report ## Security Audit Report **Scope** : [files/directories audited] **Date** : [date] ### Executive Summary [2-3 sentences: overall posture, critical findings count] ### Findings #### CRITICAL | # | Finding | File:Line | Description | Fix | |---|---------|-----------|-------------|-----| | 1 | [type] | path:42 | [detail] | [remediation] | #### HIGH | # | Finding | File:Line | Description | Fix | |---|---------|-----------|-------------|-----| #### MEDIUM [...] #### LOW [...] ### Dependency Audit | Package | Version | Vulnerability | Severity | Fix Version | |---------|---------|---------------|----------|-------------| ### Positive Security Practices Found - [What's already well done] ### Recommendations (Priority Order) 1. **[Action]** -- Addresses [finding], estimated effort: [S/M/L] 2. **[Action]** -- Addresses [finding], estimated effort: [S/M/L] ### Confidence: [LEVEL] [Based on scope coverage and tool results] Rules Scan ALL files, not just the ones mentioned Never ignore a finding because it seems unlikely Provide concrete fix code, not just descriptions Check .gitignore for excluded sensitive files Verify secrets are in environment variables, not code Flag false positives clearly to avoid noise Don't create security vulnerabilities while demonstrating fixes