1---2name: security-scan3description: Check code for OWASP top 10 vulnerabilities including injection, XSS, auth issues, and secrets exposure. Use when user says "security audit", "check for vulnerabilities", "security scan", "is this secure", "OWASP check", "find security issues", or needs to verify code security before shipping.4---56Scan code for OWASP Top 10 vulnerabilities. Report severity-rated findings with file:line references and fix recommendations. Flag what matters; skip what doesn't apply.78## Scan Categories910Work through each OWASP category. For each, search for the specific code patterns listed.1112### 1. Injection (A03:2021)1314| Pattern to find | Risk | What to verify |15|----------------|------|---------------|16| String concatenation in SQL queries | SQL injection | Use parameterized queries / prepared statements |17| Template literals in database calls | NoSQL injection | Use query builders or ORM methods with bound parameters |18| `exec()`, `spawn()`, `system()` with user input | Command injection | Validate/whitelist input, avoid shell execution |19| User input in LDAP filters | LDAP injection | Escape special characters, use parameterized filters |20| User input in regex constructors | ReDoS | Validate regex complexity, use re2 or set timeouts |21| `eval()`, `Function()`, `vm.runInContext()` | Code injection | Remove entirely; never evaluate user-controlled strings |2223### 2. Broken Authentication (A07:2021)2425| Pattern to find | Risk | What to verify |26|----------------|------|---------------|27| Plain-text password storage | Credential theft | Use bcrypt/scrypt/argon2 with proper work factor |28| Missing rate limiting on login endpoints | Brute force | Implement rate limiting and account lockout |29| Session tokens in URLs or localStorage | Session hijack | Use httpOnly secure cookies |30| JWT without expiration or with weak signing | Token forgery | Set short exp, use RS256 or ES256, rotate keys |31| Missing MFA on sensitive operations | Account takeover | Require step-up auth for destructive actions |32| Hardcoded credentials or default passwords | Unauthorized access | Use environment variables and secrets management |3334### 3. Sensitive Data Exposure (A02:2021)3536| Pattern to find | Risk | What to verify |37|----------------|------|---------------|38| API keys, tokens, passwords in source | Credential leak | Move to environment variables / secrets manager |39| Secrets in log output | Log exfiltration | Redact sensitive fields before logging |40| Missing TLS / HTTP used for sensitive data | Man-in-the-middle | Enforce HTTPS, use HSTS header |41| PII in error responses | Information disclosure | Return generic errors to clients, log details server-side |42| Sensitive data in client-side state | Browser exposure | Keep secrets server-side, minimize client-side PII |43| Missing encryption at rest | Data breach | Encrypt sensitive database columns and file storage |4445### 4. Cross-Site Scripting — XSS (A03:2021)4647| Pattern to find | Risk | What to verify |48|----------------|------|---------------|49| `dangerouslySetInnerHTML` | Stored/reflected XSS | Sanitize with DOMPurify, validate input is trusted |50| `innerHTML`, `outerHTML` assignments | DOM-based XSS | Use textContent or framework-safe rendering |51| Unescaped template interpolation in HTML | Reflected XSS | Use framework auto-escaping, never bypass it |52| URL parameters rendered without encoding | Reflected XSS | Encode output, validate URL parameters |53| `javascript:` URLs in href/src | XSS via navigation | Whitelist URL schemes (http, https, mailto) |54| User-controlled `src` on script/iframe tags | Remote code execution | Validate against allowlist of trusted origins |5556### 5. Broken Access Control (A01:2021)5758| Pattern to find | Risk | What to verify |59|----------------|------|---------------|60| Missing auth middleware on routes | Unauthorized access | Apply auth checks to every protected endpoint |61| Client-side-only permission checks | Privilege escalation | Enforce permissions server-side |62| Direct object reference without ownership check | IDOR | Verify requesting user owns / has access to resource |63| Missing role/scope validation | Privilege escalation | Check roles on every sensitive operation |64| Unrestricted file upload | Arbitrary file write | Validate file type, size, and store outside webroot |65| Path traversal in file operations | File system access | Normalize paths, reject `..`, use allowlists |6667### 6. Security Misconfiguration (A05:2021)6869| Pattern to find | Risk | What to verify |70|----------------|------|---------------|71| Debug mode enabled in production config | Information disclosure | Disable debug, verbose errors, stack traces in prod |72| Default credentials in config files | Unauthorized access | Change all defaults, enforce strong credentials |73| Missing security headers | Various attacks | See Security Headers Checklist below |74| Overly permissive CORS (`*`) | Cross-origin attacks | Restrict to specific trusted origins |75| Directory listing enabled | Information disclosure | Disable in web server configuration |76| Unnecessary services or endpoints exposed | Attack surface | Remove unused routes, admin panels, debug endpoints |7778### 7. Server-Side Request Forgery — SSRF (A10:2021)7980| Pattern to find | Risk | What to verify |81|----------------|------|---------------|82| User-supplied URLs passed to fetch/request | Internal network access | Validate against URL allowlist |83| URL redirects without validation | Open redirect / SSRF | Check destination against trusted domains |84| DNS rebinding potential | Firewall bypass | Resolve DNS before validation, pin IPs |85| Internal service URLs constructable by user | Metadata endpoint access | Block RFC 1918 ranges and cloud metadata IPs |8687### 8. Dependency Vulnerabilities (A06:2021)8889| Pattern to find | Risk | What to verify |90|----------------|------|---------------|91| Outdated packages with known CVEs | Exploitation of known flaws | Run `npm audit` / `pnpm audit` and review results |92| Unpinned dependency versions (`^`, `~`, `*`) | Supply chain attack | Pin exact versions or use lock files |93| Dependencies from untrusted sources | Malicious code | Verify package provenance, check download counts |94| Post-install scripts in dependencies | Arbitrary code execution | Audit scripts, use `--ignore-scripts` where safe |9596## Security Headers Checklist9798Verify the following headers are set on HTTP responses:99100| Header | Recommended Value | Purpose |101|--------|------------------|---------|102| `Content-Security-Policy` | Strict policy, no `unsafe-inline` / `unsafe-eval` | Prevents XSS, injection |103| `Strict-Transport-Security` | `max-age=63072000; includeSubDomains; preload` | Forces HTTPS |104| `X-Content-Type-Options` | `nosniff` | Prevents MIME-type sniffing |105| `X-Frame-Options` | `DENY` or `SAMEORIGIN` | Prevents clickjacking |106| `Referrer-Policy` | `strict-origin-when-cross-origin` | Limits referrer leakage |107| `Permissions-Policy` | Disable unused features (camera, microphone, geolocation) | Reduces attack surface |108| `X-XSS-Protection` | `0` (rely on CSP instead) | Deprecated but set explicitly |109| `Cache-Control` | `no-store` on sensitive responses | Prevents caching of secrets |110111## Output Format112113Report findings organized by severity:114115### Finding Format116117For each issue:118119- **Severity**: Critical / High / Medium / Low120- **OWASP Category**: Which category (e.g., A01 Broken Access Control)121- **Location**: `file:line` reference122- **Issue**: What was found (one sentence)123- **Evidence**: The specific code pattern or configuration124- **Fix**: Concrete recommendation with code example125- **References**: Relevant CWE number or documentation link126127### Summary128129After all findings:130131- **Total count** by severity and OWASP category132- **Top 3 risks** to address immediately133- **Attack surface assessment** (one paragraph)134- **Headers status** (pass/fail for each security header)135136**NEVER**:137- Report theoretical issues without evidence in the actual code138- Skip a category because it "probably doesn't apply" — scan every one139- Provide a fix that introduces a different vulnerability140- Report low-severity style issues in a security scan (stay focused)141- Assume a framework handles security automatically without verifying configuration
kazdenc