PDPA Security Audit
Run a comprehensive security audit mapped to PDPA 2024 (Malaysia) and OWASP Top 10 (2021). This skill is designed for developers who may not have formal security training but need to ship compliant production code.
When to Use
- Before go-live / production deploy
- When asked "is my code secure?"
- When asked about PDPA compliance
- When asked to run a security audit
- When asked about OWASP
- After major feature additions that touch auth, payments, or user data
Audit Process
Phase 1: Forensic Findings Check (PDPA 2024)
Check the codebase against all 8 findings from real Malaysian court cases:
Finding 1: SQL Injection
Search for:
DB::raw(), whereRaw(), orderByRaw() with string concatenation (Laravel)- Template literals or string concatenation in SQL queries (Node.js)
- Any query that does NOT use parameterized bindings / prepared statements
- Missing
? placeholders or $1 parameters
Pass criteria: 100% of database queries use parameterized bindings.
Finding 2: Path Traversal
Search for:
- File download endpoints that accept user-controlled paths
fs.readFile, readFileSync, createReadStream with user input- Missing
path.basename() or path sanitization
- Direct concatenation of user input with file system paths
Pass criteria: No user-controlled file paths in server-side code, or all paths sanitized with basename/allowlist.
Finding 3: Race Conditions
Search for:
- Check-then-act patterns (SELECT then UPDATE/INSERT)
- Payment/webhook handlers without idempotency guards
- Credit/balance operations without atomic conditional updates
- Missing database transactions or batch operations
Pass criteria: All financial operations use atomic patterns (conditional UPDATE, INSERT OR IGNORE + UNIQUE, or database transactions).
Finding 4: Hardcoded Secrets
Search for:
- API keys, passwords, tokens written directly in source code
.env files committed to git- Secrets in git history
- Check
.gitignore covers .env* files
Pass criteria: Zero secrets in source code. All secrets via environment variables or secret managers.
Finding 5: Audit Logging
Check for:
- Structured logging on all sensitive operations
- Timestamps on all transaction records
- Security event logging (failed auth, rejected requests, rate limits)
- Log persistence (not just ephemeral console.log)
Pass criteria: All sensitive operations produce traceable audit entries with timestamps.
Finding 6: Testing Before Go-Live
Check for:
- Test suite exists and passes
- CI/CD pipeline gates deployment on test passage
- Security-specific tests (auth boundaries, input validation)
- Dependency vulnerability scanning in CI
Pass criteria: Tests exist, run in CI, and block deployment on failure.
Finding 7: Dependency Safety
Check for:
- Suspicious or typosquatting package names
- Packages without clear provenance
- Missing lockfile
- Malicious postinstall scripts
- Unpinned versions without lockfile
Pass criteria: All dependencies are well-known, lockfile exists, no suspicious packages.
Finding 8: License Compliance
Check for:
- GPL-licensed code copied into source without compliance
- Removed copyright notices
- License file exists for the project
- node_modules not committed
Pass criteria: Project has a license, no GPL code copied without compliance, copyright notices preserved.
Phase 2: OWASP Top 10 Assessment
For each category, check controls and identify gaps:
| Category |
Key Checks |
| A01 Broken Access Control |
Auth on all protected routes, RBAC/ABAC, tenant-scoped data, no IDOR |
| A02 Cryptographic Failures |
HTTPS enforced, secrets server-side only, PII encrypted at rest, timing-safe comparisons |
| A03 Injection |
Parameterized queries, schema validation, no command execution, CSP configured |
| A04 Insecure Design |
Rate limiting, idempotency, atomic transactions, input validation |
| A05 Security Misconfiguration |
Security headers, no debug modes, sanitized errors, no CORS wildcard |
| A06 Vulnerable Components |
Dependency audit passes, lockfile exists, typosquatting checked, known CVEs tracked |
| A07 Auth Failures |
Password hashing, session management, brute-force protection, rate limiting |
| A08 Data Integrity |
CI gates (SAST, secret scanning), webhook signature verification |
| A09 Logging & Monitoring |
Structured audit logs, tamper-resistant storage, alerting |
| A10 SSRF |
No raw user-controlled server-side fetch, private IP/metadata blocking, redirect validation |
Phase 2.5: Enterprise Remediation Routing
When producing the fix list, map each finding to the dedicated remediation skill:
| Finding |
Route to |
| Broken access control, IDOR, tenant leaks, admin exposure |
$access-control-patterns |
| SQL injection, raw queries, unsafe DB calls |
$sql-injection-prevention |
| XSS, path traversal, command injection, unsafe file uploads |
$input-validation |
Hardcoded secrets, committed .env, secret rotation |
$secrets-management |
| Missing CSP/HSTS/clickjacking headers |
$security-headers |
| Weak passwords, JWT misuse, session fixation, brute-force |
$auth-hardening |
| CORS wildcard, credential leakage, unsafe preflight |
$cors-configuration |
| Plaintext PII, missing encryption, weak key management |
$data-encryption |
| Stack trace leaks, verbose production errors |
$error-handling-security |
| Missing audit trail or non-persistent logs |
$audit-logging-workers |
| Webhook replay, race conditions, missing idempotency |
$webhook-security |
| Missing SAST, secret scanning, dependency gates |
$ci-security-gates |
| Missing API abuse limits or brute-force limits |
$rate-limiting |
| SSRF, user-controlled URLs, metadata endpoint exposure |
$ssrf-prevention |
| Typosquatting, malicious packages, missing lockfile |
$dependency-lockfile-audit |
Phase 3: Output
Produce a scorecard:
## PDPA Forensic Findings
| # | Finding | Status | Evidence |
|---|---------|--------|----------|
| 1 | SQL Injection | PASS/FAIL | [file:line] |
| 2 | Path Traversal | PASS/FAIL | [file:line] |
| 3 | Race Conditions | PASS/FAIL | [file:line] |
| 4 | Hardcoded Secrets | PASS/FAIL | [file:line] |
| 5 | Audit Logging | PASS/FAIL | [file:line] |
| 6 | Testing | PASS/FAIL | [file:line] |
| 7 | Dependencies | PASS/FAIL | [file:line] |
| 8 | License | PASS/FAIL | [file:line] |
## OWASP Top 10
| Category | Rating | Key Finding |
|----------|--------|-------------|
| A01-A10 | Strong/Good/Weak | ... |
## Priority Fixes
1. [Highest risk item first]
2. ...
Legal Reference
- PDPA 2010 (Pindaan 2024) Seksyen 5(1)(2): Denda sehingga RM1,000,000 atau penjara sehingga 3 tahun
- Akta Hak Cipta 1987 Seksyen 41(1)(i): Denda RM2,000-RM20,000 per fail atau penjara 5 tahun
- Akta Kontrak 1950 Seksyen 74: Ganti rugi am dan khas
- Kanun Keseksaan Seksyen 417/419: Penjara 5-7 tahun (penipuan)
Important Notes
- This is an automated internal assessment, not a substitute for external penetration testing
- For enterprise/government contracts, commission a CREST-certified external pentest
- Security is maintenance, not a one-time task -- re-run this audit after major changes
1---2name: pdpa-security-audit3description: Full PDPA 2024 + OWASP Top 10 security audit for any codebase. Checks all 8 forensic findings from Malaysian court cases plus enterprise controls for access control, SSRF, secrets, encryption, CORS, auth hardening, and error handling. Produces a compliance scorecard and actionable fix list. Use when asked to audit security, check PDPA compliance, run OWASP assessment, or before go-live.4---56# PDPA Security Audit78Run a comprehensive security audit mapped to PDPA 2024 (Malaysia) and OWASP Top 10 (2021). This skill is designed for developers who may not have formal security training but need to ship compliant production code.910## When to Use1112- Before go-live / production deploy13- When asked "is my code secure?"14- When asked about PDPA compliance15- When asked to run a security audit16- When asked about OWASP17- After major feature additions that touch auth, payments, or user data1819## Audit Process2021### Phase 1: Forensic Findings Check (PDPA 2024)2223Check the codebase against all 8 findings from real Malaysian court cases:2425#### Finding 1: SQL Injection2627Search for:28- `DB::raw()`, `whereRaw()`, `orderByRaw()` with string concatenation (Laravel)29- Template literals or string concatenation in SQL queries (Node.js)30- Any query that does NOT use parameterized bindings / prepared statements31- Missing `?` placeholders or `$1` parameters3233**Pass criteria:** 100% of database queries use parameterized bindings.3435#### Finding 2: Path Traversal3637Search for:38- File download endpoints that accept user-controlled paths39- `fs.readFile`, `readFileSync`, `createReadStream` with user input40- Missing `path.basename()` or path sanitization41- Direct concatenation of user input with file system paths4243**Pass criteria:** No user-controlled file paths in server-side code, or all paths sanitized with basename/allowlist.4445#### Finding 3: Race Conditions4647Search for:48- Check-then-act patterns (SELECT then UPDATE/INSERT)49- Payment/webhook handlers without idempotency guards50- Credit/balance operations without atomic conditional updates51- Missing database transactions or batch operations5253**Pass criteria:** All financial operations use atomic patterns (conditional UPDATE, INSERT OR IGNORE + UNIQUE, or database transactions).5455#### Finding 4: Hardcoded Secrets5657Search for:58- API keys, passwords, tokens written directly in source code59- `.env` files committed to git60- Secrets in git history61- Check `.gitignore` covers `.env*` files6263**Pass criteria:** Zero secrets in source code. All secrets via environment variables or secret managers.6465#### Finding 5: Audit Logging6667Check for:68- Structured logging on all sensitive operations69- Timestamps on all transaction records70- Security event logging (failed auth, rejected requests, rate limits)71- Log persistence (not just ephemeral console.log)7273**Pass criteria:** All sensitive operations produce traceable audit entries with timestamps.7475#### Finding 6: Testing Before Go-Live7677Check for:78- Test suite exists and passes79- CI/CD pipeline gates deployment on test passage80- Security-specific tests (auth boundaries, input validation)81- Dependency vulnerability scanning in CI8283**Pass criteria:** Tests exist, run in CI, and block deployment on failure.8485#### Finding 7: Dependency Safety8687Check for:88- Suspicious or typosquatting package names89- Packages without clear provenance90- Missing lockfile91- Malicious postinstall scripts92- Unpinned versions without lockfile9394**Pass criteria:** All dependencies are well-known, lockfile exists, no suspicious packages.9596#### Finding 8: License Compliance9798Check for:99- GPL-licensed code copied into source without compliance100- Removed copyright notices101- License file exists for the project102- node_modules not committed103104**Pass criteria:** Project has a license, no GPL code copied without compliance, copyright notices preserved.105106### Phase 2: OWASP Top 10 Assessment107108For each category, check controls and identify gaps:109110| Category | Key Checks |111|----------|-----------|112| A01 Broken Access Control | Auth on all protected routes, RBAC/ABAC, tenant-scoped data, no IDOR |113| A02 Cryptographic Failures | HTTPS enforced, secrets server-side only, PII encrypted at rest, timing-safe comparisons |114| A03 Injection | Parameterized queries, schema validation, no command execution, CSP configured |115| A04 Insecure Design | Rate limiting, idempotency, atomic transactions, input validation |116| A05 Security Misconfiguration | Security headers, no debug modes, sanitized errors, no CORS wildcard |117| A06 Vulnerable Components | Dependency audit passes, lockfile exists, typosquatting checked, known CVEs tracked |118| A07 Auth Failures | Password hashing, session management, brute-force protection, rate limiting |119| A08 Data Integrity | CI gates (SAST, secret scanning), webhook signature verification |120| A09 Logging & Monitoring | Structured audit logs, tamper-resistant storage, alerting |121| A10 SSRF | No raw user-controlled server-side fetch, private IP/metadata blocking, redirect validation |122123### Phase 2.5: Enterprise Remediation Routing124125When producing the fix list, map each finding to the dedicated remediation skill:126127| Finding | Route to |128|---------|----------|129| Broken access control, IDOR, tenant leaks, admin exposure | `$access-control-patterns` |130| SQL injection, raw queries, unsafe DB calls | `$sql-injection-prevention` |131| XSS, path traversal, command injection, unsafe file uploads | `$input-validation` |132| Hardcoded secrets, committed `.env`, secret rotation | `$secrets-management` |133| Missing CSP/HSTS/clickjacking headers | `$security-headers` |134| Weak passwords, JWT misuse, session fixation, brute-force | `$auth-hardening` |135| CORS wildcard, credential leakage, unsafe preflight | `$cors-configuration` |136| Plaintext PII, missing encryption, weak key management | `$data-encryption` |137| Stack trace leaks, verbose production errors | `$error-handling-security` |138| Missing audit trail or non-persistent logs | `$audit-logging-workers` |139| Webhook replay, race conditions, missing idempotency | `$webhook-security` |140| Missing SAST, secret scanning, dependency gates | `$ci-security-gates` |141| Missing API abuse limits or brute-force limits | `$rate-limiting` |142| SSRF, user-controlled URLs, metadata endpoint exposure | `$ssrf-prevention` |143| Typosquatting, malicious packages, missing lockfile | `$dependency-lockfile-audit` |144145### Phase 3: Output146147Produce a scorecard:148149```markdown150## PDPA Forensic Findings151152| # | Finding | Status | Evidence |153|---|---------|--------|----------|154| 1 | SQL Injection | PASS/FAIL | [file:line] |155| 2 | Path Traversal | PASS/FAIL | [file:line] |156| 3 | Race Conditions | PASS/FAIL | [file:line] |157| 4 | Hardcoded Secrets | PASS/FAIL | [file:line] |158| 5 | Audit Logging | PASS/FAIL | [file:line] |159| 6 | Testing | PASS/FAIL | [file:line] |160| 7 | Dependencies | PASS/FAIL | [file:line] |161| 8 | License | PASS/FAIL | [file:line] |162163## OWASP Top 10164165| Category | Rating | Key Finding |166|----------|--------|-------------|167| A01-A10 | Strong/Good/Weak | ... |168169## Priority Fixes1701711. [Highest risk item first]1722. ...173```174175## Legal Reference176177- **PDPA 2010 (Pindaan 2024) Seksyen 5(1)(2):** Denda sehingga RM1,000,000 atau penjara sehingga 3 tahun178- **Akta Hak Cipta 1987 Seksyen 41(1)(i):** Denda RM2,000-RM20,000 per fail atau penjara 5 tahun179- **Akta Kontrak 1950 Seksyen 74:** Ganti rugi am dan khas180- **Kanun Keseksaan Seksyen 417/419:** Penjara 5-7 tahun (penipuan)181182## Important Notes183184- This is an automated internal assessment, not a substitute for external penetration testing185- For enterprise/government contracts, commission a CREST-certified external pentest186- Security is maintenance, not a one-time task -- re-run this audit after major changes
afu-it