Security Audit
Decision Tree
Security concern → What type?
├─ Reviewing code changes → OWASP checklist below
├─ Handling user input → Where does it go?
│ ├─ Database query → Parameterized queries (see references/injection-patterns.md)
│ ├─ HTML output → Framework escaping (see references/injection-patterns.md)
│ ├─ Shell command → Array arguments (see references/injection-patterns.md)
│ ├─ File path → Resolve + verify within allowed dir
│ └─ URL redirect → Allowlist or relative paths only
├─ Auditing dependencies → Run scanning commands below
└─ Full security audit → All phases below
Phases
Phase 1: Scan → Phase 2: Analyze → Phase 3: Report
OWASP Top 10 Checklist
| # |
Vulnerability |
Check |
| A01 |
Broken Access Control |
Auth on every endpoint, RBAC server-side, no IDOR |
| A02 |
Cryptographic Failures |
TLS everywhere, no MD5/SHA1 for passwords, secrets in env not code |
| A03 |
Injection |
Parameterized queries, no string concat for SQL/shell/HTML |
| A04 |
Insecure Design |
Rate limiting, account lockout, input size limits |
| A05 |
Security Misconfiguration |
No default creds, errors don't leak internals, CORS restricted |
| A06 |
Vulnerable Components |
Deps updated, no known CVEs, lockfile committed |
| A07 |
Auth Failures |
Strong passwords, MFA available, session timeout |
| A08 |
Data Integrity |
Signed updates, CI/CD secured, no untrusted deserialization |
| A09 |
Logging Failures |
Auth events logged, no sensitive data in logs |
| A10 |
SSRF |
URL validation, allowlists for external calls |
Scanning Commands
# Dependency vulnerabilities
npm audit # Node
pip-audit # Python (pip install pip-audit)
# Secret detection
gitleaks detect --source .
# Static analysis
semgrep --config auto . # Multi-language
bandit -r . # Python
Input Validation Checklist
| Input |
Validate |
| Strings |
Max length, allowed characters, trim whitespace |
| Numbers |
Min/max range, integer vs float, NaN check |
| Email |
Format + domain check (not just regex) |
| URLs |
Protocol allowlist (http/https only), no internal IPs |
| File uploads |
Extension allowlist, MIME check, size limit |
| JSON body |
Schema validation (zod, joi, pydantic) |
| IDs |
Format check (UUID format, positive integer) |
Response Headers
Content-Security-Policy: default-src 'self'
X-Content-Type-Options: nosniff
X-Frame-Options: DENY
Strict-Transport-Security: max-age=31536000; includeSubDomains
Output Format
[CRITICAL|HIGH|MEDIUM|LOW] Category - Finding
Location: file:line
Impact: What an attacker could do
Fix: Specific remediation
For injection prevention patterns see:
- Injection patterns reference
1---2name: security-audit3description: Security audit with OWASP top 10 checklist, dependency scanning, secrets detection, input validation, and injection prevention. Use when auditing code security, reviewing auth implementations, handling user input, or hardening applications.4---56# Security Audit78## Decision Tree910```11Security concern → What type?12 ├─ Reviewing code changes → OWASP checklist below13 ├─ Handling user input → Where does it go?14 │ ├─ Database query → Parameterized queries (see references/injection-patterns.md)15 │ ├─ HTML output → Framework escaping (see references/injection-patterns.md)16 │ ├─ Shell command → Array arguments (see references/injection-patterns.md)17 │ ├─ File path → Resolve + verify within allowed dir18 │ └─ URL redirect → Allowlist or relative paths only19 ├─ Auditing dependencies → Run scanning commands below20 └─ Full security audit → All phases below21```2223## Phases2425```26Phase 1: Scan → Phase 2: Analyze → Phase 3: Report27```2829## OWASP Top 10 Checklist3031| # | Vulnerability | Check |32|---|--------------|-------|33| A01 | Broken Access Control | Auth on every endpoint, RBAC server-side, no IDOR |34| A02 | Cryptographic Failures | TLS everywhere, no MD5/SHA1 for passwords, secrets in env not code |35| A03 | Injection | Parameterized queries, no string concat for SQL/shell/HTML |36| A04 | Insecure Design | Rate limiting, account lockout, input size limits |37| A05 | Security Misconfiguration | No default creds, errors don't leak internals, CORS restricted |38| A06 | Vulnerable Components | Deps updated, no known CVEs, lockfile committed |39| A07 | Auth Failures | Strong passwords, MFA available, session timeout |40| A08 | Data Integrity | Signed updates, CI/CD secured, no untrusted deserialization |41| A09 | Logging Failures | Auth events logged, no sensitive data in logs |42| A10 | SSRF | URL validation, allowlists for external calls |4344## Scanning Commands4546```bash47# Dependency vulnerabilities48npm audit # Node49pip-audit # Python (pip install pip-audit)5051# Secret detection52gitleaks detect --source .5354# Static analysis55semgrep --config auto . # Multi-language56bandit -r . # Python57```5859## Input Validation Checklist6061| Input | Validate |62|-------|----------|63| Strings | Max length, allowed characters, trim whitespace |64| Numbers | Min/max range, integer vs float, NaN check |65| Email | Format + domain check (not just regex) |66| URLs | Protocol allowlist (http/https only), no internal IPs |67| File uploads | Extension allowlist, MIME check, size limit |68| JSON body | Schema validation (zod, joi, pydantic) |69| IDs | Format check (UUID format, positive integer) |7071## Response Headers7273```74Content-Security-Policy: default-src 'self'75X-Content-Type-Options: nosniff76X-Frame-Options: DENY77Strict-Transport-Security: max-age=31536000; includeSubDomains78```7980## Output Format8182```83[CRITICAL|HIGH|MEDIUM|LOW] Category - Finding84 Location: file:line85 Impact: What an attacker could do86 Fix: Specific remediation87```8889## For injection prevention patterns see:90- [Injection patterns reference](references/injection-patterns.md)
BigPapiCB