# Security Auditor Saas

> Application security agent that audits code for OWASP Top 10 vulnerabilities, hardcoded secrets, and common security flaws. Triggers on: security audit, vulnerability scan, OWASP check, security review, penetration test, hardening.

- Skill: `aibot88/security-auditor-saas` (Agent Skill, multi-file: 2 files)
- Install (CLI): `npx skillmds@latest add aibot88/security-auditor-saas`
- Raw SKILL.md: https://api.skillmd.com/api/skills/aibot88/security-auditor-saas/raw
- Safety review: pending (external: skill-scanner PASS, skillspector PASS)
- Works with: Claude Code, Claude.ai, OpenAI Codex
- Category: AI & ML
- Author: aibot88 (https://skillmd.com/u/aibot88)
- Updated: 2026-09-09
- Page: https://skillmd.com/skills/aibot88/security-auditor-saas

---


# Security Auditor — Hardening Agent

## Purpose

Identify and remediate security vulnerabilities before the product is deployed.
Prevent data breaches, unauthorized access, and common attack vectors.

## When to Use

- After code and tests are complete
- Before deployment planning
- When the user asks "is this code secure?"

## Audit Checklist (OWASP Top 10 Aligned)

### 1. Injection (SQL, NoSQL, Command)
- [ ] All database queries use parameterized statements or ORM
- [ ] No string concatenation in queries
- [ ] User input is never passed directly to system commands

### 2. Broken Authentication
- [ ] Passwords are hashed with bcrypt/argon2 (never plain text, never MD5/SHA)
- [ ] Sessions expire after a reasonable timeout
- [ ] Login has rate limiting or brute-force protection
- [ ] Password reset tokens are single-use and time-limited

### 3. Sensitive Data Exposure
- [ ] No secrets in source code (API keys, passwords, tokens)
- [ ] `.env` files are in `.gitignore`
- [ ] HTTPS is enforced in production
- [ ] Sensitive data is not logged

### 4. Broken Access Control
- [ ] Users cannot access other users' data by changing IDs in URLs
- [ ] Admin routes are protected with role checks
- [ ] API endpoints verify the requesting user's permissions

### 5. Security Misconfiguration
- [ ] CORS is configured to allow only known origins
- [ ] Debug mode is disabled in production config
- [ ] Default credentials are changed
- [ ] Error messages do not expose stack traces to users

### 6. Cross-Site Scripting (XSS)
- [ ] All user-generated content is escaped/sanitized before rendering
- [ ] Content-Security-Policy headers are set
- [ ] React/Vue/Angular auto-escaping is not bypassed (no dangerouslySetInnerHTML)

### 7. Cross-Site Request Forgery (CSRF)
- [ ] CSRF tokens are used on state-changing forms
- [ ] SameSite cookie attribute is set

### 8. Insecure Dependencies
- [ ] No known vulnerable dependencies (check npm audit / pip audit)
- [ ] Dependencies are pinned to specific versions

### 9. Insufficient Logging
- [ ] Failed login attempts are logged
- [ ] Access to sensitive data is logged
- [ ] Logs do not contain passwords or tokens

### 10. Input Validation
- [ ] All inputs have type, length, and format validation
- [ ] File uploads are restricted by type and size
- [ ] Email addresses are validated

## Output

Produce a `security_audit.md` with:

| # | Finding | Severity | Location | Remediation |
|---|---|---|---|---|
| 1 | Hardcoded API key | CRITICAL | src/lib/api.js:14 | Move to .env |

## Rules
- **Critical/High findings MUST be fixed before deployment.**
- Present fixes to the CEO for approval.
- Re-audit after fixes are applied.

## Exit Criteria
- All 10 OWASP categories are checked
- All Critical/High findings are remediated
- Audit report is complete with pass/fail for each category