Source Code Security Review
Quick Start
- Identify - languages, frameworks, package managers present
- Automated SAST - run tools appropriate to the stack
- Dependency CVEs - scan lockfiles/manifests for known CVEs
- Secrets scan - detect hardcoded credentials/tokens
- Manual review - trace high-risk sinks (exec, eval, query, deserialize)
- Malicious code - check for backdoors, obfuscation, suspicious network calls
- Report - findings with CWE/CVE refs, severity, PoC, remediation
Workflow
Phase 1: Enumerate
- Languages: ls **/*.{py,js,ts,java,go,rb,php,cs,rs}
- Packages: find package.json, requirements.txt, go.mod, pom.xml, Gemfile, composer.json, Cargo.toml
- Entry points: main(), index.*, app.*, server.*
- Config files: .env*, config.*, settings.*, *.yaml, *.toml
Phase 2: Automated SAST
See sast-tools.md for commands per language.
Key tools:
- Multi-language: Semgrep (
semgrep --config=auto .)
- Python: Bandit (
bandit -r . -f json)
- JavaScript/TS: ESLint security plugin, njsscan
- Java: SpotBugs + FindSecBugs
- Go: gosec (
gosec ./...)
- PHP: PHPCS Security Audit
- Ruby: Brakeman (
brakeman -o report.json)
- All: CodeQL (via
gh codeql)
Phase 3: Dependency CVE Scan
See dependency-cve-scanning.md for commands.
| Ecosystem |
Command |
| npm/yarn |
npm audit --json / yarn audit |
| Python |
pip-audit -r requirements.txt |
| Java |
dependency-check --scan . |
| Go |
govulncheck ./... |
| Ruby |
bundle audit |
| Generic |
trivy fs . / grype dir:. |
Phase 4: Secrets Detection
See secrets-detection.md.
trufflehog filesystem . --json
gitleaks detect --source . -v
Phase 5: Manual Review
Focus on high-risk sinks — see manual-review.md:
- Injection sinks:
exec, eval, query, system, popen
- Deserialization:
pickle.loads, ObjectInputStream, unserialize
- Crypto: hardcoded keys, weak algorithms (MD5, SHA1, DES, ECB)
- Auth: JWT validation, session management, RBAC enforcement
- File ops: path construction with user input
Phase 6: Malicious Code
See malicious-code.md:
- Obfuscated strings (base64, hex, charCode)
- Unexpected network calls in library code
- Typosquatting indicators
- Postinstall/lifecycle script abuse
- Hidden backdoors in dependencies
Language-Specific Patterns
See language-patterns.md for Python, JS, Java, Go, PHP, Ruby.
Severity Mapping
| Severity |
CVSS |
Examples |
| Critical |
9.0+ |
RCE, SQLi with exfil, auth bypass |
| High |
7.0-8.9 |
Stored XSS, SSRF, insecure deserialization |
| Medium |
4.0-6.9 |
Reflected XSS, info disclosure, IDOR |
| Low |
0.1-3.9 |
Missing headers, verbose errors |
Output Format
findings/
<severity>-<vuln-type>-<location>.md # One file per finding
evidence/
<tool>-output.json # Raw tool output
summary-report.md # Executive summary
Each finding: CWE/CVE ID | File:Line | Severity | PoC | Remediation
Critical Rules
- Never execute untrusted code during review
- Treat all findings as potential until verified
- Always cross-reference CVEs against actual version in use
- Report supply chain issues separately (they affect all users)
1---2name: source-code-scanning3description: Security-focused source code review and SAST. Scans for vulnerabilities (OWASP Top 10, CWE Top 25), CVEs in third-party dependencies/packages, hardcoded secrets, malicious code, and insecure patterns. Use when given source code, a repo path, or asked to "audit", "scan", "review" code security, or "check dependencies for CVEs".4---56# Source Code Security Review78## Quick Start9101. **Identify** - languages, frameworks, package managers present112. **Automated SAST** - run tools appropriate to the stack123. **Dependency CVEs** - scan lockfiles/manifests for known CVEs134. **Secrets scan** - detect hardcoded credentials/tokens145. **Manual review** - trace high-risk sinks (exec, eval, query, deserialize)156. **Malicious code** - check for backdoors, obfuscation, suspicious network calls167. **Report** - findings with CWE/CVE refs, severity, PoC, remediation1718## Workflow1920### Phase 1: Enumerate21```22- Languages: ls **/*.{py,js,ts,java,go,rb,php,cs,rs}23- Packages: find package.json, requirements.txt, go.mod, pom.xml, Gemfile, composer.json, Cargo.toml24- Entry points: main(), index.*, app.*, server.*25- Config files: .env*, config.*, settings.*, *.yaml, *.toml26```2728### Phase 2: Automated SAST29See [sast-tools.md](reference/sast-tools.md) for commands per language.3031Key tools:32- **Multi-language**: Semgrep (`semgrep --config=auto .`)33- **Python**: Bandit (`bandit -r . -f json`)34- **JavaScript/TS**: ESLint security plugin, njsscan35- **Java**: SpotBugs + FindSecBugs36- **Go**: gosec (`gosec ./...`)37- **PHP**: PHPCS Security Audit38- **Ruby**: Brakeman (`brakeman -o report.json`)39- **All**: CodeQL (via `gh codeql`)4041### Phase 3: Dependency CVE Scan42See [dependency-cve-scanning.md](reference/dependency-cve-scanning.md) for commands.4344| Ecosystem | Command |45|---|---|46| npm/yarn | `npm audit --json` / `yarn audit` |47| Python | `pip-audit -r requirements.txt` |48| Java | `dependency-check --scan .` |49| Go | `govulncheck ./...` |50| Ruby | `bundle audit` |51| Generic | `trivy fs .` / `grype dir:.` |5253### Phase 4: Secrets Detection54See [secrets-detection.md](reference/secrets-detection.md).55```bash56trufflehog filesystem . --json57gitleaks detect --source . -v58```5960### Phase 5: Manual Review61Focus on high-risk sinks — see [manual-review.md](reference/manual-review.md):62- Injection sinks: `exec`, `eval`, `query`, `system`, `popen`63- Deserialization: `pickle.loads`, `ObjectInputStream`, `unserialize`64- Crypto: hardcoded keys, weak algorithms (MD5, SHA1, DES, ECB)65- Auth: JWT validation, session management, RBAC enforcement66- File ops: path construction with user input6768### Phase 6: Malicious Code69See [malicious-code.md](reference/malicious-code.md):70- Obfuscated strings (base64, hex, charCode)71- Unexpected network calls in library code72- Typosquatting indicators73- Postinstall/lifecycle script abuse74- Hidden backdoors in dependencies7576## Language-Specific Patterns77See [language-patterns.md](reference/language-patterns.md) for Python, JS, Java, Go, PHP, Ruby.7879## Severity Mapping8081| Severity | CVSS | Examples |82|---|---|---|83| Critical | 9.0+ | RCE, SQLi with exfil, auth bypass |84| High | 7.0-8.9 | Stored XSS, SSRF, insecure deserialization |85| Medium | 4.0-6.9 | Reflected XSS, info disclosure, IDOR |86| Low | 0.1-3.9 | Missing headers, verbose errors |8788## Output Format8990```91findings/92 <severity>-<vuln-type>-<location>.md # One file per finding93evidence/94 <tool>-output.json # Raw tool output95summary-report.md # Executive summary96```9798Each finding: CWE/CVE ID | File:Line | Severity | PoC | Remediation99100## Critical Rules101- Never execute untrusted code during review102- Treat all findings as potential until verified103- Always cross-reference CVEs against actual version in use104- Report supply chain issues separately (they affect all users)
bertbertov