Code Security

Code Security

Secret scanning, dependency vulnerability auditing, static analysis patterns, and supply chain security for the user's codebases.

Quick Start

Quick Repo Security Check

Run these in order for any repository:

# 1. Check for leaked secrets
grep -rn "sk-proj-\|sk-\|AKIA\|ghp_\|gho_\|github_pat_\|xoxb-\|xoxp-" --include="*.py" --include="*.ts" --include="*.js" --include="*.rs" --include="*.sh" --include="*.toml" --include="*.json" --include="*.yml" --include="*.yaml" --include="*.env" .

# 2. Check .gitignore covers sensitive files
cat .gitignore | grep -i "env\|secret\|key\|token\|credential"

# 3. Check for .env files in repo
find . -name ".env*" -not -path "./.git/*"

# 4. Run dependency audit (language-specific)
cargo audit          # Rust
npm audit            # JavaScript/TypeScript
pip-audit            # Python (via pip install pip-audit)

Secret Scanning

Patterns to Detect

Manual Secret Scan

# Comprehensive secret scan across a repo
grep -rn \
    -e "sk-proj-" \
    -e "sk-[A-Za-z0-9]\{20,\}" \
    -e "AKIA[0-9A-Z]\{16\}" \
    -e "ghp_" \
    -e "gho_" \
    -e "github_pat_" \
    -e "xox[bpors]-" \
    -e "BEGIN.*PRIVATE KEY" \
    -e "password\s*=" \
    -e "api_key\s*=" \
    -e "secret\s*=" \
    --include="*.py" --include="*.ts" --include="*.js" --include="*.rs" \
    --include="*.sh" --include="*.toml" --include="*.json" --include="*.yml" \
    --include="*.yaml" --include="*.env" --include="*.cfg" --include="*.ini" \
    .

Git History Check

Secrets removed from current files may still be in git history:

# Search git history for secrets (simplified)
git log --all -p | grep -n "sk-proj-\|AKIA\|ghp_\|BEGIN.*PRIVATE KEY"

# Check specific file history
git log --all -p -- "path/to/suspicious/file"

If secrets found in history:

1. Rotate the credential immediately (it's already compromised)
2. Use git filter-repo to remove from history (if critical)
3. Force push (coordinate with team)
4. Document in MEMORY.md

.gitignore Hygiene

Every repo should ignore:

# Secrets and credentials
.env
.env.*
*.pem
*.key
credentials.json
service-account.json
**/secrets/

# IDE and editor files
.idea/
.vscode/settings.json
*.swp

# OS files
.DS_Store
Thumbs.db

Audit checklist:

• .env and .env.* are in .gitignore
• No .env files are tracked: git ls-files | grep "\.env"
• Private keys (.pem, .key) are ignored
• Credential JSON files are ignored
• No sensitive files in git history

Dependency Vulnerability Audit

Rust (cargo audit)

# Install cargo-audit if not present
cargo install cargo-audit

# Run audit
cargo audit

# JSON output for parsing
cargo audit --json

# Fix by updating Cargo.lock
cargo update
cargo audit

Evaluate findings:

JavaScript / TypeScript (npm audit)

# Run audit
npm audit

# Fix automatically where possible
npm audit fix

# Force fix (may include breaking changes)
npm audit fix --force

# JSON output
npm audit --json

Python (pip-audit)

# Install pip-audit
pip install pip-audit

# Audit current environment
pip-audit

# Audit a requirements file
pip-audit -r requirements.txt

# JSON output
pip-audit --format json

Supply Chain Risk Indicators

Look for these red flags in dependencies:

Static Analysis (SAST) Patterns

Common Vulnerability Patterns

Command Injection:

# Dangerous patterns
os.system(user_input)
subprocess.call(user_input, shell=True)
exec(user_input)
eval(user_input)

Path Traversal:

# Dangerous patterns
open(user_input)               # Unsanitized file path
os.path.join(base, user_input) # Without validation

SQL Injection:

# Dangerous patterns
f"SELECT * FROM users WHERE id = {user_input}"
cursor.execute("SELECT * FROM users WHERE id = " + user_input)

Hardcoded Credentials:

# Dangerous patterns
password = "hardcoded_value"
API_KEY = "sk-..."
conn_string = "postgres://user:pass@host/db"

Language-Specific Checks

Rust:

# Check for unsafe blocks
grep -rn "unsafe" --include="*.rs" .

# Check for unwrap (potential panics)
grep -rn "\.unwrap()" --include="*.rs" .

# Run clippy with security lints
cargo clippy -- -W clippy::all

Python:

# Check for dangerous functions
grep -rn "eval\|exec\|os.system\|subprocess.call.*shell=True" --include="*.py" .

# Check for pickle (deserialization risk)
grep -rn "pickle\|cPickle" --include="*.py" .

# Run bandit (Python SAST)
pip install bandit
bandit -r . -f json

Shell Scripts:

# Check for unquoted variables (injection risk)
# shellcheck is the best tool for this
shellcheck *.sh

# Check for eval with variables
grep -rn 'eval.*\$' --include="*.sh" .

Code Security Report Format

# Code Security Report: [Repository Name]

**Date:** YYYY-MM-DD
**Analyst:** Zero
**Repository:** [path or URL]
**Commit:** [short hash]

## Summary

| Category | Critical | High | Medium | Low |
|---|---|---|---|---|
| Secrets | X | X | X | X |
| Dependencies | X | X | X | X |
| Code patterns | X | X | X | X |

## Findings

### Secrets
[List any found secrets with file:line references]

### Dependency Vulnerabilities
[List from cargo audit / npm audit / pip-audit]

### Code Vulnerabilities
[List from SAST scan with file:line references]

## Recommendations

1. [Prioritized actions]

## .gitignore Status

- [ ] Adequate for this project type
- [ ] Missing entries: [list]

Zero skill — Code security analysis and dependency auditing