Add Security Audit

Security Audit

Use for: Validate security, audit codebase, identify vulnerabilities Do not use for: Writing security fixes, dependency upgrades, incident response, general code review

Reference: Always consult CLAUDE.md for general project standards.

OWASP Checklist

A01 — Broken Access Control (CRITICAL)

Multi-tenant rules:

• ALL queries filter by account_id
• account_id from JWT (NEVER body)
• Ownership validated before UPDATE/DELETE
• Guards on protected endpoints

Searches to run:

• grep 'findAll|selectFrom' → check account_id filter
• grep '@Body()' → check no accountId from body

A02 — Cryptographic Failures

• Credentials encrypted
• Passwords NEVER in logs
• Tokens not in responses
• API keys via env vars
• Secrets not committed

Searches:

• grep 'sk_live|api_key|secret' → no hardcoded
• grep 'logger|console' → no sensitive data

A03 — Injection (CRITICAL)

SQL/NoSQL:

• Parametrized queries
• Validated inputs
• No .raw() with user input

Command injection:

• No exec/spawn with user input

Searches:

• grep 'raw(' → check user input
• grep '${' in queries → SQL injection

A04 — Insecure Design

• Guards on ALL protected routes
• JWT expiration
• Refresh token handling
• Logout invalidates session

Search: grep '@Get|@Post' → check @UseGuards.

A05 — Misconfiguration

• CORS not origin:'*' in prod
• Debug disabled in prod
• No stack traces exposed
• Deps updated

Secrets/env vars: see A02.

Searches:

• grep 'origin.*\*' → open CORS
• grep 'process.env' → use IConfigurationService

A06 — Vulnerable Components

• npm audit no critical/high
• Deps regularly updated

Command: npm audit --json | grep -E 'critical|high'.

A07 — Auth Failures

• bcrypt/argon2 for passwords
• Rate limiting on auth
• MFA available
• Secure password recovery

A08 — Integrity Failures

• Deps from trusted sources
• Lock files committed
• CI/CD security validations

A09 — Logging Failures

• Sufficient context for debug
• Log unauthorized access attempts

Sensitive data in logs: see A02.

A10 — SSRF

• External URLs validated/whitelisted
• No arbitrary user URLs
• Validate hostnames before fetch

Extra — XSS

• Outputs sanitized
• No dangerouslySetInnerHTML (or sanitized)
• URLs validated in href/src

Search: grep 'dangerouslySetInnerHTML' → check sanitization.

Extra — Mass Assignment

• Explicit DTOs (no body spread)
• Use @Expose/@Exclude
• Validate PartialType

Search: grep '...body|...dto' → spread vulnerability.

Scoring

Formula: score = 10 - (weighted_sum / 5)

Process

1. Setup: Read security.md, CLAUDE.md, identify scope files
2. Analyze: For EACH OWASP category → run searches → verify (no false positives) → classify severity
3. Multi-Tenant: Check ALL queries filter account_id, ID from JWT
4. Report: Calculate score, group by severity, create security-report.md

Output Template

# Security Audit Report

**Date:** [date] | **Scope:** [path]

## Score

| Category | Status | Findings |
|----------|--------|----------|
| Access Control | ✅/⚠️/❌ | X |
| Crypto | ✅/⚠️/❌ | X |
| Injection | ✅/⚠️/❌ | X |
| Auth | ✅/⚠️/❌ | X |
| Config | ✅/⚠️/❌ | X |
| XSS | ✅/⚠️/❌ | X |
| Deps | ✅/⚠️/❌ | X |
| **OVERALL** | **⚠️** | **X** |

## Critical Findings

### Finding #1
**Category:** [OWASP] | **Severity:** 🔴 | **File:** `path:line`

**Vulnerable Code:** [code]
**Impact:** [simple language]
**Recommendation:** [fix]

## Positive Points
- [good practices found]

## Priority Actions
1. [most urgent]
2. [second]
3. [third]

Rules

• Analyze ALL files in scope, check ALL OWASP categories, include exact line, explain impact simply
• Verify context to avoid false positives; do not flag minor findings without justification
• Report only — never auto-fix
• Avoid jargon without explanation

False Positive Prevention

Stack-specific protections (NestJS sanitization, Kysely parametrization, React escaping, etc.) and accepted patterns (e.g. process.env.NODE_ENV, internal .raw(), validated PartialType): consult CLAUDE.md for the project's stack and documented exceptions.

Project patterns:

• Check documented patterns
• IConfigurationService is correct
• Don't report as violation if it follows the docs