Security Audit
Overview
Systematic security review covering OWASP Top 10, dependency vulnerabilities, secrets, and secure patterns.
Process
Phase 1: SCAN -> Automated scans (deps, secrets, patterns)
Phase 2: ANALYZE -> Manual review of high-risk areas
Phase 3: CLASSIFY -> Rate findings by severity
Phase 4: RECOMMEND -> Propose fixes with priority
Phase 1: Automated Scans
Dependency Vulnerabilities
# JavaScript/TypeScript
npm audit
# Python
uv run pip-audit
# Rust
cargo audit
Secrets Detection
Search for hardcoded secrets using Grep:
Patterns to search for:
- API keys: long alphanumeric strings in config files
- Credentials: password/token/secret assignments with literal values
- Cloud provider keys: AWS access key patterns (starts with AKIA)
- Private key headers: PEM format key blocks
- Connection strings: database URIs containing embedded credentials
- .env files: verify .env is listed in .gitignore
Use Grep tool to search for these patterns across the codebase. Focus on:
- Configuration files (.config., *.yml, *.yaml, *.json, *.toml)
- Source code with string assignments to variables named key, secret, token, password
- Environment variable files that should NOT be committed
Dangerous Code Patterns
Search with Grep for:
| Pattern |
Risk |
What to Search |
| eval/exec |
Code injection |
eval(, exec(, Function( |
| SQL concatenation |
SQL injection |
String concatenation in SQL queries |
| Shell execution |
Command injection |
subprocess.call, os.system, child_process.exec |
| Unsafe HTML |
XSS |
dangerouslySetInnerHTML, innerHTML =, v-html |
| Unsafe deserialization |
RCE |
pickle.load, yaml.load without SafeLoader |
| Open redirect |
Phishing |
Redirects using user-controlled input |
| Path traversal |
File access |
../ patterns in user-controlled paths |
Phase 2: Manual Review
OWASP Top 10 Checklist
| # |
Vulnerability |
What to Check |
| A01 |
Broken Access Control |
Auth middleware on all routes, RBAC, CORS |
| A02 |
Cryptographic Failures |
TLS, proper password hashing (bcrypt/argon2), no weak hashing for passwords |
| A03 |
Injection |
SQL parameterized queries, XSS escaping, command injection |
| A04 |
Insecure Design |
Business logic flaws, missing rate limiting |
| A05 |
Security Misconfiguration |
Default credentials, verbose errors in prod, CORS wildcard |
| A06 |
Vulnerable Components |
Outdated deps, known CVEs |
| A07 |
Auth Failures |
Session management, brute force protection, MFA |
| A08 |
Data Integrity |
Unsigned updates, CI/CD pipeline security |
| A09 |
Logging Failures |
Missing audit logs, PII in logs |
| A10 |
SSRF |
Unvalidated URLs, internal network access |
Authentication Review
Check:
- Password storage -> bcrypt/argon2 (NOT md5/sha1/sha256)
- Session management -> Secure, HttpOnly, SameSite cookies
- JWT -> Algorithm validation, expiry, refresh tokens
- Rate limiting -> Login attempts, API endpoints
- CORS -> Not wildcard for authenticated routes
- CSRF -> Tokens on state-changing operations
Input Validation Review
Check:
- User inputs -> Validated and sanitized at entry
- File uploads -> Type validation, size limits, no path traversal
- API parameters -> Schema validation (zod, pydantic, joi)
- Database queries -> Parameterized, no string concatenation
- Redirects -> Whitelist-only destinations
Phase 3: Classify Findings
| Severity |
Criteria |
Action |
| CRITICAL |
Remote code execution, auth bypass, data leak |
Fix immediately |
| HIGH |
XSS, SQL injection, broken access control |
Fix before deploy |
| MEDIUM |
Missing headers, weak validation, info disclosure |
Fix soon |
| LOW |
Best practice violations, minor misconfigs |
Plan fix |
| INFO |
Suggestions, hardening opportunities |
Optional |
Phase 4: Report
## Security Audit Report
**Scope**: [files/directories audited]
**Date**: [date]
### Executive Summary
[2-3 sentences: overall posture, critical findings count]
### Findings
#### CRITICAL
| # | Finding | File:Line | Description | Fix |
|---|---------|-----------|-------------|-----|
| 1 | [type] | path:42 | [detail] | [remediation] |
#### HIGH
| # | Finding | File:Line | Description | Fix |
|---|---------|-----------|-------------|-----|
#### MEDIUM
[...]
#### LOW
[...]
### Dependency Audit
| Package | Version | Vulnerability | Severity | Fix Version |
|---------|---------|---------------|----------|-------------|
### Positive Security Practices Found
- [What's already well done]
### Recommendations (Priority Order)
1. **[Action]** -- Addresses [finding], estimated effort: [S/M/L]
2. **[Action]** -- Addresses [finding], estimated effort: [S/M/L]
### Confidence: [LEVEL]
[Based on scope coverage and tool results]
Rules
- Scan ALL files, not just the ones mentioned
- Never ignore a finding because it seems unlikely
- Provide concrete fix code, not just descriptions
- Check .gitignore for excluded sensitive files
- Verify secrets are in environment variables, not code
- Flag false positives clearly to avoid noise
- Don't create security vulnerabilities while demonstrating fixes
1---2name: security-audit3description: Proactive security audit: OWASP top 10, dependency vulnerabilities, secrets detection, input validation, auth patterns, and secure defaults. MUST BE USED when user mentions: "security", "vulnerability", "audit", "OWASP", "CVE", "security review", "pentest", "injection", "XSS", "CSRF", "authentication", "authorization", "secrets", "hardcoded password", "secure", "npm audit", "pip-audit", "check security", "is this secure", "security risk", "data leak", "SQL injection", "command injection", "path traversal", "SSRF", "RCE", "privilege escalation", "supply chain", "dependency scan", "snyk", "trivy", "semgrep", "bandit". Scans code for vulnerabilities, checks dependencies, verifies auth patterns. NOT for explaining security concepts (use pedagogical-explain), or general code review (use code-review).4---56# Security Audit78## Overview910Systematic security review covering OWASP Top 10, dependency vulnerabilities, secrets, and secure patterns.1112## Process1314```15Phase 1: SCAN -> Automated scans (deps, secrets, patterns)16Phase 2: ANALYZE -> Manual review of high-risk areas17Phase 3: CLASSIFY -> Rate findings by severity18Phase 4: RECOMMEND -> Propose fixes with priority19```2021## Phase 1: Automated Scans2223### Dependency Vulnerabilities2425```bash26# JavaScript/TypeScript27npm audit2829# Python30uv run pip-audit3132# Rust33cargo audit34```3536### Secrets Detection3738Search for hardcoded secrets using Grep:3940```41Patterns to search for:42- API keys: long alphanumeric strings in config files43- Credentials: password/token/secret assignments with literal values44- Cloud provider keys: AWS access key patterns (starts with AKIA)45- Private key headers: PEM format key blocks46- Connection strings: database URIs containing embedded credentials47- .env files: verify .env is listed in .gitignore48```4950Use Grep tool to search for these patterns across the codebase. Focus on:51- Configuration files (*.config.*, *.yml, *.yaml, *.json, *.toml)52- Source code with string assignments to variables named key, secret, token, password53- Environment variable files that should NOT be committed5455### Dangerous Code Patterns5657Search with Grep for:5859| Pattern | Risk | What to Search |60|---------|------|----------------|61| eval/exec | Code injection | `eval(`, `exec(`, `Function(` |62| SQL concatenation | SQL injection | String concatenation in SQL queries |63| Shell execution | Command injection | `subprocess.call`, `os.system`, `child_process.exec` |64| Unsafe HTML | XSS | `dangerouslySetInnerHTML`, `innerHTML =`, `v-html` |65| Unsafe deserialization | RCE | `pickle.load`, `yaml.load` without SafeLoader |66| Open redirect | Phishing | Redirects using user-controlled input |67| Path traversal | File access | `../` patterns in user-controlled paths |6869## Phase 2: Manual Review7071### OWASP Top 10 Checklist7273| # | Vulnerability | What to Check |74|---|--------------|---------------|75| A01 | Broken Access Control | Auth middleware on all routes, RBAC, CORS |76| A02 | Cryptographic Failures | TLS, proper password hashing (bcrypt/argon2), no weak hashing for passwords |77| A03 | Injection | SQL parameterized queries, XSS escaping, command injection |78| A04 | Insecure Design | Business logic flaws, missing rate limiting |79| A05 | Security Misconfiguration | Default credentials, verbose errors in prod, CORS wildcard |80| A06 | Vulnerable Components | Outdated deps, known CVEs |81| A07 | Auth Failures | Session management, brute force protection, MFA |82| A08 | Data Integrity | Unsigned updates, CI/CD pipeline security |83| A09 | Logging Failures | Missing audit logs, PII in logs |84| A10 | SSRF | Unvalidated URLs, internal network access |8586### Authentication Review8788```89Check:90- Password storage -> bcrypt/argon2 (NOT md5/sha1/sha256)91- Session management -> Secure, HttpOnly, SameSite cookies92- JWT -> Algorithm validation, expiry, refresh tokens93- Rate limiting -> Login attempts, API endpoints94- CORS -> Not wildcard for authenticated routes95- CSRF -> Tokens on state-changing operations96```9798### Input Validation Review99100```101Check:102- User inputs -> Validated and sanitized at entry103- File uploads -> Type validation, size limits, no path traversal104- API parameters -> Schema validation (zod, pydantic, joi)105- Database queries -> Parameterized, no string concatenation106- Redirects -> Whitelist-only destinations107```108109## Phase 3: Classify Findings110111| Severity | Criteria | Action |112|----------|----------|--------|113| CRITICAL | Remote code execution, auth bypass, data leak | Fix immediately |114| HIGH | XSS, SQL injection, broken access control | Fix before deploy |115| MEDIUM | Missing headers, weak validation, info disclosure | Fix soon |116| LOW | Best practice violations, minor misconfigs | Plan fix |117| INFO | Suggestions, hardening opportunities | Optional |118119## Phase 4: Report120121```markdown122## Security Audit Report123124**Scope**: [files/directories audited]125**Date**: [date]126127### Executive Summary128[2-3 sentences: overall posture, critical findings count]129130### Findings131132#### CRITICAL133| # | Finding | File:Line | Description | Fix |134|---|---------|-----------|-------------|-----|135| 1 | [type] | path:42 | [detail] | [remediation] |136137#### HIGH138| # | Finding | File:Line | Description | Fix |139|---|---------|-----------|-------------|-----|140141#### MEDIUM142[...]143144#### LOW145[...]146147### Dependency Audit148| Package | Version | Vulnerability | Severity | Fix Version |149|---------|---------|---------------|----------|-------------|150151### Positive Security Practices Found152- [What's already well done]153154### Recommendations (Priority Order)1551. **[Action]** -- Addresses [finding], estimated effort: [S/M/L]1562. **[Action]** -- Addresses [finding], estimated effort: [S/M/L]157158### Confidence: [LEVEL]159[Based on scope coverage and tool results]160```161162## Rules163164- Scan ALL files, not just the ones mentioned165- Never ignore a finding because it seems unlikely166- Provide concrete fix code, not just descriptions167- Check .gitignore for excluded sensitive files168- Verify secrets are in environment variables, not code169- Flag false positives clearly to avoid noise170- Don't create security vulnerabilities while demonstrating fixes
aedelon