# Audit Checklists

> Security audit checklists for JavaScript/TypeScript web applications covering authentication, API, frontend, infrastructure, and data protection. Use during security audits, code reviews, or when the user asks for a security checklist.

- Skill: `leo4135/audit-checklists` (Agent Skill)
- Install (CLI): `npx skillmds@latest add leo4135/audit-checklists`
- Raw SKILL.md: https://api.skillmd.com/api/skills/leo4135/audit-checklists/raw
- Safety review: pending
- Works with: Claude Code, Claude.ai, OpenAI Codex
- Category: Web & Frontend
- Author: leo4135 (https://skillmd.com/u/leo4135)
- Updated: 2026-09-22
- Page: https://skillmd.com/skills/leo4135/audit-checklists

---


# Security Audit Checklists

Use these checklists during audits. Mark each item: ✅ pass, ❌ fail, ⚠️ partial, N/A.

## General Application

- [ ] All user input validated and sanitized at trust boundaries
- [ ] Output encoding applied contextually (HTML, URL, JS, CSS)
- [ ] Authentication required for protected resources
- [ ] Authorization checked on every request (not just UI hiding)
- [ ] Session tokens are cryptographically random, HttpOnly, Secure, SameSite
- [ ] Passwords hashed with bcrypt/argon2/scrypt (cost factor ≥ 10)
- [ ] Rate limiting on auth, password reset, and sensitive endpoints
- [ ] CSRF protection on state-changing requests (cookie-based auth)
- [ ] Security headers configured (CSP, HSTS, X-Frame-Options, etc.)
- [ ] Secrets not in source control or client bundles
- [ ] Error messages don't leak stack traces or internal paths in production
- [ ] Logging excludes PII, tokens, passwords
- [ ] File uploads validated (type, size, content, storage path)

## API Security

- [ ] Input schema validation (Zod, Joi, class-validator, etc.)
- [ ] Authentication on all non-public endpoints
- [ ] Object-level authorization (no IDOR via predictable IDs)
- [ ] Pagination limits enforced (no unbounded queries)
- [ ] Mass assignment prevented (allowlist fields)
- [ ] GraphQL: depth/complexity limits, introspection disabled in prod
- [ ] REST: proper HTTP methods, no sensitive ops via GET
- [ ] API versioning and deprecation policy
- [ ] CORS allowlist (not `*` with credentials)
- [ ] Request size limits configured

## Frontend / Client

- [ ] No secrets in client-side code or `NEXT_PUBLIC_*` / `VITE_*` env vars
- [ ] `dangerouslySetInnerHTML` avoided or sanitized (DOMPurify)
- [ ] Third-party scripts loaded with SRI hashes
- [ ] postMessage handlers validate `event.origin`
- [ ] localStorage/sessionStorage doesn't hold sensitive tokens
- [ ] JWT not stored in localStorage (prefer HttpOnly cookies)
- [ ] Client-side routing doesn't bypass server auth
- [ ] Source maps disabled or restricted in production

## Authentication & Identity

- [ ] MFA available for privileged accounts
- [ ] Account lockout / rate limiting after failed attempts
- [ ] Secure password reset flow (time-limited tokens, no user enumeration)
- [ ] OAuth state parameter validated (CSRF)
- [ ] OIDC nonce validated
- [ ] JWT: algorithm allowlist (reject `none`, verify `alg` header)
- [ ] JWT expiry enforced, refresh token rotation
- [ ] Logout invalidates server-side session

## Data Protection

- [ ] Sensitive data encrypted at rest
- [ ] TLS 1.2+ enforced, HSTS enabled
- [ ] PII minimized and classified
- [ ] Database queries parameterized (no string concatenation)
- [ ] ORM raw queries audited for injection
- [ ] Backup encryption and access controls
- [ ] Data retention and deletion policies implemented

## Infrastructure & DevOps

- [ ] `.env` files gitignored, secrets in vault/CI secrets
- [ ] Docker images scanned, non-root user, minimal base image
- [ ] CI/CD secrets scoped minimally, no secrets in logs
- [ ] Dependency lock files committed and verified
- [ ] Production debug mode disabled
- [ ] Admin interfaces not publicly exposed
- [ ] WAF / rate limiting at edge (if applicable)

## Node.js Specific

- [ ] `NODE_ENV=production` in production
- [ ] `child_process` not called with user input
- [ ] `eval`, `new Function`, `vm` avoided
- [ ] Prototype pollution mitigated (`Object.create(null)` for maps)
- [ ] `express.json()` body size limit set
- [ ] Helmet or equivalent security middleware
- [ ] Path traversal prevented in file operations (`path.resolve` + prefix check)

## Quick Scan Commands

```bash
# Dangerous patterns
rg -n "eval\(|new Function\(|innerHTML\s*=|dangerouslySetInnerHTML" --glob "*.{js,ts,jsx,tsx}"

# Hardcoded secrets (review each hit)
rg -n "(api[_-]?key|secret|password|token)\s*[:=]\s*['\"][^'\"]{8,}" --glob "*.{js,ts,json}" -i

# SQL injection risk
rg -n "query\(|execute\(|raw\(|\.query\(\`" --glob "*.{js,ts}" 

# Missing auth middleware
rg -n "router\.(get|post|put|delete|patch)" --glob "*.{js,ts}" -A2
```

## Checklist Output Format

When reporting checklist results:

```markdown
## Checklist: [Category]
- ✅ Input validation at boundaries — Zod schemas on all API routes
- ❌ CSRF protection — cookie auth without CSRF tokens on POST /api/transfer
- ⚠️ Rate limiting — only on /login, missing on /api/*
- N/A MFA — internal tool, SSO handled by IdP
```