Audit Infra

Infrastructure Audit

Cross-cutting infrastructure audit covering secrets management, Docker configuration, dependency security, CORS, webhook security, migration rollback safety, CI/CD, logging, and monitoring.

Detection Strategy

Auto-detect infrastructure components by scanning for:

• docker-compose.yml / Dockerfile — containerized services
• .github/workflows/ / .gitlab-ci.yml / Jenkinsfile — CI/CD pipelines
• *.env* files — environment configuration
• migrations/ — database migration files
• nginx.conf / caddy / reverse proxy configs
• package.json / go.mod / requirements.txt — dependency manifests

Checks

1. Secrets in Repository

Grep across all source (excluding .env.example, docs, and test fixtures):

• API keys: (?:api[_-]?key|apikey)\s*[:=]\s*["'][A-Za-z0-9]{16,}["']
• Passwords: password\s*[:=]\s*["'][^"']{4,}["']
• Private keys: -----BEGIN.*PRIVATE KEY-----
• Connection strings with credentials: ://[^:]+:[^@]+@
• Generic tokens: (?:secret|token|jwt_secret)\s*[:=]\s*["'][A-Za-z0-9]{16,}["'] Also check: .env files committed to git (git ls-files '*.env') FAIL for any real credentials in tracked source files.

2. .env.example Completeness

Extract all environment variable references from source code:

• Go: os\.Getenv\("([^"]+)"\)|viper\.Get.*\("([^"]+)"\)
• JS/TS: process\.env\.([A-Z_]+)|import\.meta\.env\.([A-Z_]+)
• Python: os\.environ\[["']([^"']+)["']\]|os\.getenv\(["']([^"']+)["']\) Cross-reference against .env.example or .env.project.example. WARN for environment variables referenced in code but missing from example files.

3. Docker Non-Root Execution

Read all Dockerfile files. Check:

• USER directive present (not running as root)?
• Base image is specific version (not :latest)?
• No secrets in build args or ENV directives?
• Multi-stage builds used to minimize image size? WARN for root execution. WARN for :latest base images.

4. Dependency Vulnerabilities

# npm projects
find . -name "package.json" -not -path "*/node_modules/*" -maxdepth 3 -execdir npm audit --production 2>/dev/null \; | grep -E "critical|high|moderate" | head -20
# Go projects
find . -name "go.mod" -maxdepth 3 -execdir sh -c 'command -v govulncheck >/dev/null && govulncheck ./... 2>&1 | tail -10 || echo "govulncheck not installed"' \;
# Python projects
find . -name "requirements.txt" -maxdepth 3 -execdir sh -c 'command -v pip-audit >/dev/null && pip-audit 2>&1 | tail -10 || echo "pip-audit not installed"' \;

FAIL for critical/high. WARN for moderate.

5. Outdated Base Dependencies

Check for significantly outdated core packages:

# npm
find . -name "package.json" -not -path "*/node_modules/*" -maxdepth 3 -execdir npm outdated 2>/dev/null \; | head -20
# Go
find . -name "go.mod" -maxdepth 3 -execdir sh -c 'go list -m -u all 2>/dev/null | grep "\[" | head -10' \;

WARN for major version behind. Info for minor/patch.

6. CORS Production Configuration

Grep for CORS configuration:

• Access-Control-Allow-Origin|AllowOrigins|cors.*origin Check: wildcard * with credentials is a FAIL. Wildcard * without credentials is WARN. Check that development-only permissive CORS is behind an environment guard.

7. Webhook HTTPS Enforcement

Grep for webhook URL configuration:

• webhook.*url|setWebhook|webhook_url|WEBHOOK_URL Check all webhook URLs use https:// in production configuration. WARN for http:// webhook URLs outside of local development guards.

8. Migration Rollback Safety

List all up/forward migrations. Check:

• Each has a matching down/rollback migration
• Down migrations are non-empty (not just a comment)
• No destructive operations (DROP TABLE, DROP COLUMN) without careful sequencing

find . -path "*/migrations/*.up.sql" -o -path "*/migrations/*.up.*" | while read f; do
  down=$(echo "$f" | sed 's/\.up\./\.down\./');
  [ ! -f "$down" ] && echo "MISSING ROLLBACK: $(basename $f)"
done

FAIL for missing rollback files. WARN for empty rollbacks.

9. CI/CD Pipeline Checks

Read CI/CD configuration files. Verify:

• Linting step present?
• Test step present?
• Security scanning step (SAST/DAST)?
• Build step validates compilation?
• No secrets hardcoded in pipeline files? WARN for missing critical steps (lint, test, build).

10. Log Level Configuration

Grep for logger initialization:

• Go: zap\.New|zerolog\.New|logrus\.New
• JS/TS: winston\.createLogger|pino\(|bunyan\.createLogger
• Python: logging\.basicConfig|logging\.getLogger Check that log level is configurable via environment variable (not hardcoded to debug). WARN if debug logging is hardcoded or if sensitive data appears in log statements.

11. Backup Verification

Check for database backup configuration:

• pg_dump|mysqldump|mongodump in scripts or cron
• Backup-related environment variables
• Docker volume configuration for persistent data WARN if no backup mechanism is visible in the repository.

12. Monitoring and Health Checks

Check for:

• Health check endpoint (/healthz, /health, /ready, /live)
• Docker HEALTHCHECK directive in Dockerfiles
• Monitoring/alerting configuration (Prometheus metrics, Datadog, etc.)
• Error tracking integration (Sentry, Bugsnag, etc.) WARN for missing health checks. Info for missing monitoring/alerting.

Output Format

[PASS/WARN/FAIL] #N description — details (file:line if applicable)

End with summary: X PASS, Y WARN, Z FAIL and action items list for FAILs.