/security-audit

name: security-audit
description: |-
  Proactive security audit: OWASP top 10, dependency vulnerabilities, secrets detection,
  input validation, auth patterns, and secure defaults.
  MUST BE USED when user mentions: "security", "vulnerability", "audit", "OWASP", "CVE",
  "security review", "pentest", "injection", "XSS", "CSRF", "authentication",
  "authorization", "secrets", "hardcoded password", "secure", "npm audit", "pip-audit",
  "check security", "is this secure", "security risk", "data leak", "SQL injection",
  "command injection", "path traversal", "SSRF", "RCE", "privilege escalation",
  "supply chain", "dependency scan", "snyk", "trivy", "semgrep", "bandit".
  Scans code for vulnerabilities, checks dependencies, verifies auth patterns.
  NOT for explaining security concepts (use pedagogical-explain),
  or general code review (use code-review).
allowed-tools:
  - Read
  - Grep
  - Glob
  - Bash
  - WebSearch
  - WebFetch
  - Agent

Security Audit

Overview

Systematic security review covering OWASP Top 10, dependency vulnerabilities, secrets, and secure patterns.

Process

Phase 1: SCAN      -> Automated scans (deps, secrets, patterns)
Phase 2: ANALYZE   -> Manual review of high-risk areas
Phase 3: CLASSIFY  -> Rate findings by severity
Phase 4: RECOMMEND -> Propose fixes with priority

Phase 1: Automated Scans

Dependency Vulnerabilities

# JavaScript/TypeScript
npm audit

# Python
uv run pip-audit

# Rust
cargo audit

Secrets Detection

Search for hardcoded secrets using Grep:

Patterns to search for:
- API keys: long alphanumeric strings in config files
- Credentials: password/token/secret assignments with literal values
- Cloud provider keys: AWS access key patterns (starts with AKIA)
- Private key headers: PEM format key blocks
- Connection strings: database URIs containing embedded credentials
- .env files: verify .env is listed in .gitignore

Use Grep tool to search for these patterns across the codebase. Focus on:

• Configuration files (*.config.*, *.yml, *.yaml, *.json, *.toml)
• Source code with string assignments to variables named key, secret, token, password
• Environment variable files that should NOT be committed

Dangerous Code Patterns

Search with Grep for:

| Pattern | Risk | What to Search | |---------|------|----------------| | eval/exec | Code injection | `eval(`, `exec(`, `Function(` | | SQL concatenation | SQL injection | String concatenation in SQL queries | | Shell execution | Command injection | `subprocess.call`, `os.system`, `child_process.exec` | | Unsafe HTML | XSS | `dangerouslySetInnerHTML`, `innerHTML =`, `v-html` | | Unsafe deserialization | RCE | `pickle.load`, `yaml.load` without SafeLoader | | Open redirect | Phishing | Redirects using user-controlled input | | Path traversal | File access | `../` patterns in user-controlled paths |

Phase 2: Manual Review

OWASP Top 10 Checklist

| # | Vulnerability | What to Check | |---|--------------|---------------| | A01 | Broken Access Control | Auth middleware on all routes, RBAC, CORS | | A02 | Cryptographic Failures | TLS, proper password hashing (bcrypt/argon2), no weak hashing for passwords | | A03 | Injection | SQL parameterized queries, XSS escaping, command injection | | A04 | Insecure Design | Business logic flaws, missing rate limiting | | A05 | Security Misconfiguration | Default credentials, verbose errors in prod, CORS wildcard | | A06 | Vulnerable Components | Outdated deps, known CVEs | | A07 | Auth Failures | Session management, brute force protection, MFA | | A08 | Data Integrity | Unsigned updates, CI/CD pipeline security | | A09 | Logging Failures | Missing audit logs, PII in logs | | A10 | SSRF | Unvalidated URLs, internal network access |

Authentication Review

Check:
- Password storage    -> bcrypt/argon2 (NOT md5/sha1/sha256)
- Session management  -> Secure, HttpOnly, SameSite cookies
- JWT                 -> Algorithm validation, expiry, refresh tokens
- Rate limiting       -> Login attempts, API endpoints
- CORS                -> Not wildcard for authenticated routes
- CSRF                -> Tokens on state-changing operations

Input Validation Review

Check:
- User inputs         -> Validated and sanitized at entry
- File uploads        -> Type validation, size limits, no path traversal
- API parameters      -> Schema validation (zod, pydantic, joi)
- Database queries    -> Parameterized, no string concatenation
- Redirects           -> Whitelist-only destinations

Phase 3: Classify Findings

| Severity | Criteria | Action | |----------|----------|--------| | CRITICAL | Remote code execution, auth bypass, data leak | Fix immediately | | HIGH | XSS, SQL injection, broken access control | Fix before deploy | | MEDIUM | Missing headers, weak validation, info disclosure | Fix soon | | LOW | Best practice violations, minor misconfigs | Plan fix | | INFO | Suggestions, hardening opportunities | Optional |

Phase 4: Report

## Security Audit Report

**Scope**: [files/directories audited]
**Date**: [date]

### Executive Summary
[2-3 sentences: overall posture, critical findings count]

### Findings

#### CRITICAL
| # | Finding | File:Line | Description | Fix |
|---|---------|-----------|-------------|-----|
| 1 | [type] | path:42 | [detail] | [remediation] |

#### HIGH
| # | Finding | File:Line | Description | Fix |
|---|---------|-----------|-------------|-----|

#### MEDIUM
[...]

#### LOW
[...]

### Dependency Audit
| Package | Version | Vulnerability | Severity | Fix Version |
|---------|---------|---------------|----------|-------------|

### Positive Security Practices Found
- [What's already well done]

### Recommendations (Priority Order)
1. **[Action]** -- Addresses [finding], estimated effort: [S/M/L]
2. **[Action]** -- Addresses [finding], estimated effort: [S/M/L]

### Confidence: [LEVEL]
[Based on scope coverage and tool results]

Rules

• Scan ALL files, n