Javascript Security Audit

JavaScript Security Audit

End-to-end security audit workflow for JavaScript/TypeScript web applications.

When to Use

• Full project security audit
• Pre-release security review
• Security posture assessment
• "Find security vulnerabilities in this codebase"

Audit Workflow

Copy and track progress:

Audit Progress:
- [ ] Phase 1: Reconnaissance & scope
- [ ] Phase 2: Threat modeling
- [ ] Phase 3: Static analysis (code review)
- [ ] Phase 4: Dependency audit
- [ ] Phase 5: Framework-specific checks
- [ ] Phase 6: OWASP Top 10 mapping
- [ ] Phase 7: Supply chain review
- [ ] Phase 8: Report & remediation plan

Phase 1: Reconnaissance

1. Identify stack: runtime (Node/Browser/Edge), framework, auth, data stores, deployment
2. Map attack surface: public routes, APIs, WebSockets, file uploads, admin panels
3. Locate secrets: .env*, config files, CI/CD, Docker, cloud bindings
4. Read existing security docs: SECURITY.md, auth middleware, CSP headers

# Quick stack discovery
find . -maxdepth 3 \( -name package.json -o -name tsconfig.json -o -name wrangler.jsonc \) 2>/dev/null
rg -l "express|fastify|hono|next|nuxt|react|vue|svelte" --glob package.json

Phase 2: Threat Modeling

Load threat-modeling skill. Produce STRIDE analysis for the project's trust boundaries.

Phase 3: Static Analysis

Run automated tools when available, then manual review:

npm audit --json 2>/dev/null || true
npx --yes audit-ci --moderate 2>/dev/null || true
rg -n "eval\(|new Function\(|innerHTML|dangerouslySetInnerHTML|document\.write" --glob "*.{js,ts,jsx,tsx,vue,svelte}"
rg -n "password|secret|api[_-]?key|token|private[_-]?key" --glob "*.{js,ts,env*,json,yml,yaml}" -i
rg -n "exec\(|execSync|spawn\(|child_process" --glob "*.{js,ts}"

Manual focus areas:

• Input validation at trust boundaries
• Authentication & session handling
• Authorization (IDOR, privilege escalation)
• Cryptography misuse
• Error handling & information disclosure
• CORS, CSP, security headers

Phase 4: Dependency Audit

Load dependency-audit skill.

Phase 5: Framework-Specific Checks

Load framework-security-checks skill. Match detected framework.

Phase 6: OWASP Mapping

Load owasp-javascript skill. Map findings to OWASP Top 10 categories.

Phase 7: Supply Chain

Load supply-chain-security skill.

Phase 8: Report

Use the report template below. For vulnerability disclosure format, see security-bug-reporting.

Report Template

# Security Audit Report — [Project Name]

**Date:** [YYYY-MM-DD]
**Scope:** [paths/modules reviewed]
**Stack:** [detected stack]

## Executive Summary
[2-3 sentences: overall risk level, critical count, top concern]

## Risk Summary
| Severity | Count |
|----------|-------|
| Critical | N |
| High     | N |
| Medium   | N |
| Low      | N |
| Info     | N |

## Findings

### [SEVERITY] [Title]
- **Category:** OWASP A0X / CWE-XXX
- **Location:** `path/to/file.ts:line`
- **Description:** [what is wrong]
- **Impact:** [what an attacker can do]
- **Evidence:** [code snippet or tool output]
- **Remediation:** [specific fix]
- **References:** [links]

## Threat Model Summary
[Link to STRIDE table from Phase 2]

## Dependency Summary
[Known CVEs, outdated packages, license risks]

## Remediation Roadmap
1. **Immediate (0-7 days):** [critical/high fixes]
2. **Short-term (1-4 weeks):** [medium fixes]
3. **Long-term:** [architecture improvements]

## Checklist Coverage
See [audit-checklists](../audit-checklists/SKILL.md) — note unchecked items.

Severity Ratings

Additional Resources

• Checklists: audit-checklists
• Threat models: threat-modeling
• Framework checks: framework-security-checks
• OWASP: owasp-javascript
• Dependencies: dependency-audit
• Supply chain: supply-chain-security
• Bug reports: security-bug-reporting