Defense

Defense in Depth — Security Validation

Multi-layered security audit for web applications. Runs checks across 8 security layers.

Workflow

Run each layer sequentially. Report findings with severity (CRITICAL / HIGH / MEDIUM / LOW) and file:line references.

Layer 1: Secrets Scanning

Search for hardcoded secrets, API keys, tokens, and credentials.

grep -rn "API_KEY\|SECRET_KEY\|DATABASE_URL\|PRIVATE_KEY\|password\s*=\|sk_live\|sk_test" . \
  --include="*.ts" --include="*.tsx" --include="*.js" --include="*.py" --include="*.env" \
  | grep -v node_modules | grep -v ".next" | grep -v ".env.example" | grep -v __pycache__

Check:

• No secrets in source code (should be in .env only)
• .env is in .gitignore
• No secrets in git history: git log --all -p -S "sk_live\|API_KEY\|SECRET" -- . ':!.env*' | head -50

Layer 2: Authentication & Authorization

• Session handling: Token expiry, httpOnly/secure/sameSite cookies, invalidation on logout
• Route protection: Every API route checks auth before processing
• Role enforcement: Different user types can only access their own resources
• IDOR prevention: Resource access scoped by authenticated user

# Find potentially unprotected API routes
find . -path "*/api/*/route.ts" -o -path "*/api/*/route.js" | xargs grep -L "auth\|session\|token\|verify" 2>/dev/null

Layer 3: Input Validation

• All user inputs validated (schemas, type checks)
• No raw SQL — use parameterized queries / ORM only
• No command injection via string interpolation in shell calls
• File uploads have type/size restrictions
• URL parameters sanitized

# Check for template literal SQL or shell commands
grep -rn "exec(\`\|sql\`\|query(\`" . --include="*.ts" --include="*.js" | grep -v node_modules

Layer 4: Encryption

• At rest: Sensitive data encrypted in database
• In transit: HTTPS enforced, no HTTP fallbacks
• Key management: Keys in env vars, not source code, not logged

Layer 5: OWASP Top 10

# Dependency vulnerabilities
npm audit --production 2>/dev/null | head -50

Layer 6: API Security

• Webhook signature verification (Stripe, etc.)
• API keys not exposed to client-side code
• Rate limiting on public endpoints
• CORS properly configured
• Content-Type validation

Layer 7: Rate Limiting & DoS Protection

• API routes have rate limiting
• Login endpoints have brute force protection
• File upload size limits enforced
• Expensive operations throttled

Layer 8: Sensitive Data Protection

• PII never logged
• PII not exposed in error messages
• Sensitive fields excluded from API responses
• Data retention policies enforced

# Check for PII in logs
grep -rn "console\.\(log\|error\|warn\).*\(password\|ssn\|social\|secret\|token\)" . \
  --include="*.ts" --include="*.js" | grep -v node_modules

Report Format

## Security Audit Report

### Critical Findings
- [CRITICAL] Description — file:line

### High Findings
- [HIGH] Description — file:line

### Medium/Low Findings
- [MEDIUM/LOW] Description — file:line

### Passed Checks
- [PASS] Layer description