Securify

You are being invoked via the /securify skill. Your task is to perform a comprehensive security audit of the current repository, identify vulnerabilities, and produce an actionable report. You must also specifically assess API security posture.

Overview

This skill covers:

1. Detect project type and languages
2. Scan dependencies for known CVEs
3. Audit code for OWASP Top 10 and common security anti-patterns
4. Check API endpoints for authentication, authorization, and input validation gaps
5. Detect hardcoded secrets and credentials
6. Review security-related configuration files
7. Generate a prioritized vulnerability report with remediation guidance

Step 1 — Detect Project Type

Identify all languages and frameworks in use by checking for:

• package.json → Node.js / TypeScript
• requirements.txt / pyproject.toml / Pipfile → Python
• go.mod → Go
• Cargo.toml → Rust
• pom.xml / build.gradle → Java / Kotlin
• Gemfile → Ruby
• *.csproj → C# / .NET

Note all detected stacks — a repo may have multiple (e.g. a Node.js frontend + Python backend).

Step 2 — Dependency Vulnerability Scan

Run the appropriate dependency scanner for each detected stack. Do NOT skip this step.

Node.js

npm audit --json 2>/dev/null || yarn audit --json 2>/dev/null

Parse the output and list packages with severity: critical, high, moderate, low.

Python

pip-audit --format=json 2>/dev/null || safety check --json 2>/dev/null

If neither is installed, fall back to:

pip list --format=json | python3 -c "import sys,json; pkgs=json.load(sys.stdin); print('\n'.join(f'{p[\"name\"]}=={p[\"version\"]}' for p in pkgs))"

and note that pip-audit/safety should be installed for full scanning.

Go

govulncheck ./... 2>/dev/null

If not available:

go list -m all 2>/dev/null

and recommend installing govulncheck.

Rust

cargo audit 2>/dev/null

Ruby

bundle audit check --update 2>/dev/null

Java

Check for known vulnerable versions of common dependencies in pom.xml or build.gradle (Log4Shell, Spring4Shell, etc.).

For each vulnerability found, record:

• Package name and version
• CVE ID (if available)
• Severity: CRITICAL / HIGH / MEDIUM / LOW
• Description
• Fixed version (if available)

Step 3 — Secret and Credential Detection

Search the entire repository (excluding .git/) for accidentally committed secrets.

Patterns to search for (use Grep):

API Keys and tokens:

(api[_-]?key|apikey)\s*[:=]\s*['"]?[A-Za-z0-9\-_]{16,}
(secret[_-]?key|secret)\s*[:=]\s*['"]?[A-Za-z0-9\-_]{16,}
(access[_-]?token|auth[_-]?token)\s*[:=]\s*['"]?[A-Za-z0-9\-_\.]{16,}
Bearer\s+[A-Za-z0-9\-_\.]{20,}

Cloud provider credentials:

AKIA[0-9A-Z]{16}                          # AWS Access Key ID
(?i)aws.{0,20}secret.{0,20}['\"][0-9a-zA-Z/+]{40}   # AWS Secret
AIza[0-9A-Za-z\-_]{35}                    # Google API Key
[0-9]+-[0-9A-Za-z_]{32}\.apps\.googleusercontent\.com  # Google OAuth
sk-[a-zA-Z0-9]{48}                        # OpenAI API Key
ghp_[a-zA-Z0-9]{36}                       # GitHub Personal Access Token
ghs_[a-zA-Z0-9]{36}                       # GitHub App Token

Database connection strings:

(mongodb|postgres|postgresql|mysql|redis):\/\/[^:]+:[^@]+@
DATABASE_URL\s*=\s*['"]?[^\s'"]+

Private keys:

-----BEGIN (RSA |EC |DSA |OPENSSH )?PRIVATE KEY-----

Passwords:

password\s*[:=]\s*['"][^'"]{8,}['"]
passwd\s*[:=]\s*['"][^'"]{8,}['"]

For each match, record:

• File path and line number
• Type of secret detected
• Severity: CRITICAL (private keys, cloud credentials) / HIGH (API keys, tokens) / MEDIUM (passwords in config)

Check .gitignore to confirm .env files are excluded. If not, flag it.

Step 4 — API Security Audit

Find all API route definitions using Grep. Then for each route, evaluate the security controls below.

4a. Locate API Routes

Search for route definitions matching the detected framework:

Express/Fastify/Koa (Node.js):

(app|router)\.(get|post|put|patch|delete|all)\s*\(

FastAPI/Flask (Python):

@(app|router)\.(get|post|put|patch|delete)\(

Go (Gin/Echo/Chi/Fiber):

\.(GET|POST|PUT|PATCH|DELETE|Any)\s*\(

Rails:

(get|post|put|patch|delete)\s+['"]\/
resources\s+:

4b. For Each Route, Check:

Authentication

• Does the route have an auth middleware/guard/decorator?
  • Express: authMiddleware, authenticate, verifyToken, requireAuth, passport.authenticate
  • FastAPI: Depends(get_current_user), Security(...)
  • NestJS: @UseGuards(AuthGuard), @UseGuards(JwtAuthGuard)
  • Go: middleware chain applied before handler
• Flag any route that handles sensitive data (user info, payments, admin) without authentication

Authorization

• After authentication, is there authorization (RBAC/ABAC)?
  • Look for: role checks, permission checks, hasRole(), can(), @Roles(), @RequirePermission()
• Flag routes that allow any authenticated user to access admin/privileged resources without role checks

Input Validation

• Is request body/query/path input validated?
  • Express: express-validator, joi, zod, yup
  • FastAPI: Pydantic models
  • Go: binding tags binding:"required", validate:"..."
  • NestJS: class-validator DTOs
• Flag routes that read req.body, request.json(), or query params without validation

Rate Limiting

• Is there a rate limiter applied globally or per-route?
  • Express: express-rate-limit, rate-limiter-flexible
  • FastAPI: slowapi
  • Go: tollbooth, golang.org/x/time/rate
• Flag public auth endpoints (/login, /register, /forgot-password) without rate limiting

CORS

• Check CORS configuration:
  • Is origin: '*' used in production (over-permissive)?
  • Are credentials (withCredentials) allowed with wildcard origin?
  • Look for: cors(), CORSMiddleware, Access-Control-Allow-Origin

HTTPS / TLS

• Are there any HTTP redirects to HTTPS?
• Is HSTS configured?
• Look for: helmet(), security headers, SECURE_SSL_REDIRECT

SQL Injection

• Search for raw query string concatenation:

  query\s*[+]=?\s*.*req\.(body|params|query)
  execute\s*\(\s*f['"]\s*SELECT
  cursor\.execute\s*\(\s*['"].*%s.*%.*request
  db\.raw\s*\(.*\+
  

• Flag any parameterized query bypass patterns

Command Injection

• Search for dangerous subprocess calls with user input:

  exec\s*\(.*req\.(body|params|query)
  subprocess\.(run|call|Popen).*request
  os\.system\s*\(.*input
  child_process\.exec\s*\(.*req
  

Path Traversal

• Search for file system operations with user-controlled paths:

  fs\.(readFile|writeFile|readdir)\s*\(.*req\.(body|params|query)
  open\s*\(.*request\.(form|args|json)
  

XSS (for server-side rendering)

• Search for unescaped user input in templates:

  innerHTML\s*=\s*.*req
  dangerouslySetInnerHTML
  render_template_string\s*\(.*request
  

4c. Summarize API Security Findings

For each finding, note:

• Route: POST /api/auth/login
• Issue: Missing rate limiting
• Severity: HIGH
• File: src/routes/auth.ts:42
• Recommendation: Apply express-rate-limit with max 5 attempts per 15 minutes

Step 5 — Security Configuration Review

Check for insecure security-related configuration:

Environment Variables

• Is there a .env.example present? If not, flag it.
• Are any sensitive defaults set in .env.example (e.g., SECRET_KEY=mysecretkey)?

Security Headers

• Is helmet (Node.js), django-csp, or equivalent used?
• Are the following headers set?
  • Content-Security-Policy
  • X-Frame-Options
  • X-Content-Type-Options
  • Strict-Transport-Security
  • Referrer-Policy

Session Configuration

• Is session secret a hardcoded weak string?
• Are cookies set with httpOnly: true, secure: true, sameSite: 'strict'?

JWT Configuration

• Are JWTs using HS256 with a weak/hardcoded secret? (Should use RS256 or strong HS256 secret)
• Is token expiry set (missing expiresIn is a vulnerability)?
• Is jwt.verify() used (not just jwt.decode() which skips verification)?

Docker / Container

• Is the app running as root in Docker? (Look for USER directive in Dockerfile)
• Are secrets passed as ARG or ENV in Dockerfile (leaked in image layers)?

Dependencies

• Is package-lock.json / yarn.lock / poetry.lock committed? (Ensures reproducible, auditable builds)

Step 6 — Generate Vulnerability Report

Create the file docs/SECURITY_AUDIT.md with the following structure:

# Security Audit Report

**Generated:** <current date>
**Repository:** <repo name>
**Audited By:** /securify skill

---

## Executive Summary

| Severity | Count |
|----------|-------|
| 🔴 CRITICAL | X |
| 🟠 HIGH | X |
| 🟡 MEDIUM | X |
| 🔵 LOW | X |
| **Total** | **X** |

---

## 1. Dependency Vulnerabilities

### CRITICAL

#### [Package Name] vX.Y.Z — CVE-XXXX-XXXX
- **Description:** Brief description of the vulnerability
- **Fix:** Upgrade to vX.Y.Z
- **Command:** `npm update package-name` or `pip install --upgrade package-name`

### HIGH
...

### MEDIUM
...

---

## 2. Secrets & Credentials Found

### CRITICAL — Hardcoded Private Key
- **File:** `config/server.key:1`
- **Issue:** RSA private key committed to repository
- **Action:** Remove immediately, rotate the key, add to `.gitignore`

### HIGH — API Key Exposed
- **File:** `src/config.js:12`
- **Issue:** API key hardcoded in source file
- **Action:** Move to environment variable, invalidate and regenerate the key

---

## 3. API Security Issues

### Authentication Gaps

#### 🔴 CRITICAL — Admin Endpoint Without Authentication
- **Route:** `DELETE /api/admin/users/:id`
- **File:** `src/routes/admin.ts:78`
- **Issue:** No authentication middleware applied
- **Fix:** Add auth guard before handler

#### 🟠 HIGH — Missing Rate Limiting on Auth Endpoints
- **Routes:** `POST /api/auth/login`, `POST /api/auth/forgot-password`
- **Issue:** No rate limiting — vulnerable to brute force attacks
- **Fix:**
  ```javascript
  const loginLimiter = rateLimit({ windowMs: 15 * 60 * 1000, max: 5 });
  router.post('/auth/login', loginLimiter, loginHandler);

🟡 MEDIUM — Overly Permissive CORS

• File: src/app.ts:15
• Issue: origin: '*' allows any domain to make requests
• Fix: Specify allowed origins explicitly:

  cors({ origin: ['https://yourdomain.com'] })
  

Input Validation Gaps

🟠 HIGH — SQL Injection Risk

• File: src/db/queries.ts:34
• Issue: User input concatenated into raw SQL query
• Fix: Use parameterized queries:

  // UNSAFE:
  db.query(`SELECT * FROM users WHERE id = ${req.params.id}`)
  // SAFE:
  db.query('SELECT * FROM users WHERE id = $1', [req.params.id])
  

Authorization Issues

🟠 HIGH — Missing Role Check on Admin Route

• Route: GET /api/admin/stats
• File: src/routes/admin.ts:12
• Issue: Route is authenticated but any user can access admin data
• Fix: Add role check middleware

4. Security Configuration Issues

🟡 MEDIUM — Security Headers Not Set

• Issue: No helmet or equivalent security headers middleware
• Fix:

  import helmet from 'helmet';
  app.use(helmet());
  

🔵 LOW — Cookies Missing Security Flags

• File: src/session.ts:8
• Issue: Session cookies not set with httpOnly and secure flags
• Fix:

  cookie: { httpOnly: true, secure: process.env.NODE_ENV === 'production', sameSite: 'strict' }
  

5. Recommended Next Steps

Immediate Actions (CRITICAL)

1. Rotate any exposed secrets/API keys immediately
2. Add authentication to unprotected admin endpoints
3. Remove hardcoded credentials from source code

Short-term (HIGH)

1. Add rate limiting to all authentication endpoints
2. Fix SQL injection vulnerabilities with parameterized queries
3. Upgrade vulnerable dependencies

Medium-term (MEDIUM/LOW)

1. Add helmet for security headers
2. Restrict CORS to known origins
3. Configure secure cookie flags
4. Set up automated dependency scanning in CI

6. Automated Security Tools to Add

Based on this project's stack, consider adding these tools:

Dependency Scanning (CI)

# .github/workflows/security.yml
- name: Dependency audit
  run: npm audit --audit-level=high

Static Analysis

• Node.js: eslint-plugin-security, semgrep
• Python: bandit, semgrep
• Go: gosec
• Rust: cargo-audit

Secret Scanning

- name: Secret scan
  uses: trufflesecurity/trufflehog@main
  with:
    path: ./
    base: main

This report was generated automatically by the /securify skill. Manual review is recommended for complex logic vulnerabilities.

---

## Step 7 — Add Security CI Workflow

Create or update `.github/workflows/security.yml` with appropriate security scanning jobs:

```yaml
name: Security Scan

on:
  push:
    branches: [main, master]
  pull_request:
    branches: [main, master]
  schedule:
    - cron: '0 6 * * 1'  # Weekly on Monday at 6am

jobs:
  dependency-audit:
    name: Dependency Vulnerability Scan
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - name: Setup Node.js
        uses: actions/setup-node@v4
        with:
          node-version: '20'
      - run: npm ci
      - run: npm audit --audit-level=high

  secret-scan:
    name: Secret Detection
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
        with:
          fetch-depth: 0
      - name: TruffleHog Secret Scan
        uses: trufflesecurity/trufflehog@main
        with:
          path: ./
          base: ${{ github.event.repository.default_branch }}
          head: HEAD
          extra_args: --only-verified

  sast:
    name: Static Analysis
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - name: Semgrep SAST
        uses: returntocorp/semgrep-action@v1
        with:
          config: >-
            p/security-audit
            p/owasp-top-ten
            p/jwt
            p/sql-injection

Only create this file if .github/workflows/ already exists or the user has a GitHub Actions setup. Otherwise, note it as a recommendation.

Step 8 — Update CLAUDE.md

Add a security workflow section to CLAUDE.md (only if CLAUDE.md exists):

### Security Auditing

- Use the `/securify` skill to scan for vulnerabilities before major releases or when adding new API endpoints
- Run `/securify` after adding new dependencies to check for known CVEs
- Never commit `.env` files or hardcoded secrets — use environment variables
- Ensure all API endpoints have authentication and rate limiting where appropriate
- Review `docs/SECURITY_AUDIT.md` for outstanding security issues

Step 9 — Final Summary

After completing all steps, output a concise summary to the user:

Security Audit Complete
=======================

Repository: <name>
Stack detected: <e.g., Node.js (Express), Python (FastAPI)>

Findings:
  🔴 CRITICAL  X issues
  🟠 HIGH      X issues
  🟡 MEDIUM    X issues
  🔵 LOW       X issues

Top priorities:
  1. <Most critical finding with file:line>
  2. <Second most critical finding>
  3. <Third most critical finding>

Full report: docs/SECURITY_AUDIT.md

Recommended tools to install:
  - <tool> for <purpose>

Important Notes

• Do NOT modify any source code — only report findings and suggest fixes
• Do NOT expose or print full secret values — truncate to first 4 and last 4 characters when referencing found secrets (e.g., sk-ab...xy12)
• Flag when .env is missing from .gitignore
• Prioritize API endpoint security findings since exposed APIs are the primary attack surface
• If no vulnerabilities are found in a category, explicitly state "No issues found" for clarity
• When tools like pip-audit, govulncheck, or cargo audit are not installed, note it in the report and include install instructions