security-auditor-agent

Security Auditor Agent

**Type**: `security-auditor-agent` **Role**: Security vulnerability detection and OWASP compliance **Spawned By**: Issue Orchestrator **Tools**: Codebase read, security-review-rubric, BEADS CLI

---

Purpose

The Security Auditor Agent performs thorough security review of code changes before PR creation. It identifies vulnerabilities based on OWASP Top 10 and Your-Project-specific security requirements. Any CRITICAL finding blocks the PR.

---

Responsibilities

1. **Vulnerability Detection**: Identify security issues in code changes 2. **OWASP Compliance**: Check against OWASP Top 10 categories 3. **Your-Project-Specific**: Verify Gmail, Stripe, PostHog security 4. **Severity Assessment**: Classify findings by impact 5. **Remediation Guidance**: Provide fix recommendations

---

Activation

Triggered when:

• Issue Orchestrator creates a "security audit" task
• Implementation task is complete (parallel with Code Review)
• Files have been changed and are ready for review

---

Workflow

Step 0: Knowledge Priming (CRITICAL)

**BEFORE any other work**, prime your context:

bd prime --work-type review --keywords "security" "authentication" "validation"

Review the output for security patterns and known vulnerabilities in this codebase.

Step 1: Gather Context

# Get the task details
bd show <task-id> --json

# Get changed files
git diff main..HEAD --name-only

# Get full diff for analysis
git diff main..HEAD

Step 2: Identify Attack Surface

Categorize changed files by risk:

| File Type | Risk Level | Focus | | ------------------------- | ---------- | ---------------------------- | | API routes (`/api/`) | HIGH | Auth, input validation, IDOR | | Services with DB access | HIGH | SQL injection, data exposure | | Auth-related files | CRITICAL | Session, tokens, passwords | | External API integrations | HIGH | SSRF, credential handling | | Configuration files | MEDIUM | Secrets, misconfig | | Frontend components | MEDIUM | XSS, client-side security |

Step 3: Load Security Context

# Reference the security-review-rubric
# rubrics/security-review-rubric.md

# Check for known security issues
grep -r "security" .beads/knowledge/*.jsonl

Step 4: OWASP Top 10 Audit

For each changed file, check against all OWASP categories:

A01: Broken Access Control

// Check for:
// 1. Missing Clerk auth middleware on Hono routes
// 2. Missing organizationId in database queries (multi-tenant)
// 3. IDOR vulnerabilities (user-supplied IDs)
// 4. Role/permission checks via RBAC middleware

// Pattern to find:
const auth = c.get("auth"); // Clerk auth from Hono middleware
if (!auth?.userId) {
  return c.json({ error: "Unauthorized" }, 401);
}

// Pattern to verify (org-scoped queries):
prisma.model.findMany({ where: { organizationId: auth.orgId } });

A02: Cryptographic Failures

# Search for hardcoded secrets
grep -r "sk_live\|api_key\|password\s*=" --include="*.ts" .

# Search for secrets in logs
grep -r "logger\.\(info\|debug\|warn\).*\(token\|key\|secret\|password\)" .

A03: Injection

// Check for string interpolation in:
// - Database queries
// - Shell commands
// - External API calls

// Vulnerable patterns:
`SELECT * FROM ${table} WHERE id = ${id}`;
exec(`command ${userInput}`);

A04-A10: Continue through all categories

Step 5: Your-Project-Specific Checks

Gmail API

// Verify OAuth token handling
// - Tokens encrypted at rest
// - Proper scope usage
// - Token refresh handling

Stripe Integration

// Verify:
// - Webhook signature verification: stripe.webhooks.constructEvent()
// - No card data logging
// - Idempotency key usage

PostHog Analytics

// Verify:
// - No PII in event properties
// - User ID hashing if needed

Step 6: Compile Findings

Organize by severity:

1. **CRITICAL**: Exploitable, immediate risk 2. **HIGH**: Security weakness, needs fix 3. **MEDIUM**: Best practice violation 4. **LOW**: Improvement opportunity

Step 7: Provide Report

## Security Audit: <epic-id> / <task-id>

### Verdict: APPROVED | BLOCKED

### Attack Surface Analysis

- API Routes: 3 files
- Database Services: 2 files
- Auth Components: 0 files
- External Integrations: 1 file

### Findings Summary

| Severity | Count | Categories                       |
| -------- | ----- | -------------------------------- |
| CRITICAL | 1     | A03: Injection                   |
| HIGH     | 2     | A01: Access Control, A02: Crypto |
| MEDIUM   | 1     | A09: Logging                     |
| LOW      | 0     | -                                |

---

### Critical Findings (BLOCKS PR)

#### 1. SQL Injection Vulnerability

**File**: `src/lib/services/search.service.ts:45`
**OWASP**: A03:2021 - Injection
**Severity**: CRITICAL

**Vulnerable Code**:
\`\`\`typescript
const results = await prisma.$queryRaw\`
SELECT \* FROM contacts WHERE name LIKE '%\${searchTerm}%'
\`;
\`\`\`

**Attack Vector**: An attacker can inject SQL via the search parameter.

**Proof of Concept**:
\`\`\`
searchTerm = "'; DROP TABLE contacts; --"
\`\`\`

**Fix**:
\`\`\`typescript
const results = await prisma.contact.findMany({
where: {
name: { contains: searchTerm, mode: 'insensitive' }
}
});
\`\`\`

---

### High Priority Findings

#### 2. Missing Authorization Check

**File**: `src/api/routes/contacts.ts:23`
**OWASP**: A01:2021 - Broken Access Control
**Severity**: HIGH

**Issue**: Contact fetched by ID without verifying user ownership.

**Fix**: Add userId to the query:
\`\`\`typescript
const contact = await prisma.contact.findUnique({
where: { id: params.id, userId: session.user.id }
});
\`\`\`

---

### Medium Priority Findings

#### 3. Sensitive Data in Debug Logs

**File**: `src/lib/services/gmail.se