# Javascript Security Audit

> Orchestrates end-to-end security audits of JavaScript/TypeScript web applications. Use when the user asks for a security audit, vulnerability assessment, security review, penetration test preparation, or wants to find security bugs in a JS/TS project.

- Skill: `leo4135/javascript-security-audit` (Agent Skill)
- Install (CLI): `npx skillmds@latest add leo4135/javascript-security-audit`
- Raw SKILL.md: https://api.skillmd.com/api/skills/leo4135/javascript-security-audit/raw
- Safety review: pending
- Works with: Claude Code, Claude.ai, OpenAI Codex
- Category: Security
- Author: leo4135 (https://skillmd.com/u/leo4135)
- Updated: 2026-09-22
- Page: https://skillmd.com/skills/leo4135/javascript-security-audit

---


# JavaScript Security Audit

End-to-end security audit workflow for JavaScript/TypeScript web applications.

## When to Use

- Full project security audit
- Pre-release security review
- Security posture assessment
- "Find security vulnerabilities in this codebase"

## Audit Workflow

Copy and track progress:

```
Audit Progress:
- [ ] Phase 1: Reconnaissance & scope
- [ ] Phase 2: Threat modeling
- [ ] Phase 3: Static analysis (code review)
- [ ] Phase 4: Dependency audit
- [ ] Phase 5: Framework-specific checks
- [ ] Phase 6: OWASP Top 10 mapping
- [ ] Phase 7: Supply chain review
- [ ] Phase 8: Report & remediation plan
```

### Phase 1: Reconnaissance

1. Identify stack: runtime (Node/Browser/Edge), framework, auth, data stores, deployment
2. Map attack surface: public routes, APIs, WebSockets, file uploads, admin panels
3. Locate secrets: `.env*`, config files, CI/CD, Docker, cloud bindings
4. Read existing security docs: `SECURITY.md`, auth middleware, CSP headers

```bash
# Quick stack discovery
find . -maxdepth 3 \( -name package.json -o -name tsconfig.json -o -name wrangler.jsonc \) 2>/dev/null
rg -l "express|fastify|hono|next|nuxt|react|vue|svelte" --glob package.json
```

### Phase 2: Threat Modeling

Load [threat-modeling](../threat-modeling/SKILL.md) skill. Produce STRIDE analysis for the project's trust boundaries.

### Phase 3: Static Analysis

Run automated tools when available, then manual review:

```bash
npm audit --json 2>/dev/null || true
npx --yes audit-ci --moderate 2>/dev/null || true
rg -n "eval\(|new Function\(|innerHTML|dangerouslySetInnerHTML|document\.write" --glob "*.{js,ts,jsx,tsx,vue,svelte}"
rg -n "password|secret|api[_-]?key|token|private[_-]?key" --glob "*.{js,ts,env*,json,yml,yaml}" -i
rg -n "exec\(|execSync|spawn\(|child_process" --glob "*.{js,ts}"
```

Manual focus areas:
- Input validation at trust boundaries
- Authentication & session handling
- Authorization (IDOR, privilege escalation)
- Cryptography misuse
- Error handling & information disclosure
- CORS, CSP, security headers

### Phase 4: Dependency Audit

Load [dependency-audit](../dependency-audit/SKILL.md) skill.

### Phase 5: Framework-Specific Checks

Load [framework-security-checks](../framework-security-checks/SKILL.md) skill. Match detected framework.

### Phase 6: OWASP Mapping

Load [owasp-javascript](../owasp-javascript/SKILL.md) skill. Map findings to OWASP Top 10 categories.

### Phase 7: Supply Chain

Load [supply-chain-security](../supply-chain-security/SKILL.md) skill.

### Phase 8: Report

Use the report template below. For vulnerability disclosure format, see [security-bug-reporting](../security-bug-reporting/SKILL.md).

## Report Template

```markdown
# Security Audit Report — [Project Name]

**Date:** [YYYY-MM-DD]
**Scope:** [paths/modules reviewed]
**Stack:** [detected stack]

## Executive Summary
[2-3 sentences: overall risk level, critical count, top concern]

## Risk Summary
| Severity | Count |
|----------|-------|
| Critical | N |
| High     | N |
| Medium   | N |
| Low      | N |
| Info     | N |

## Findings

### [SEVERITY] [Title]
- **Category:** OWASP A0X / CWE-XXX
- **Location:** `path/to/file.ts:line`
- **Description:** [what is wrong]
- **Impact:** [what an attacker can do]
- **Evidence:** [code snippet or tool output]
- **Remediation:** [specific fix]
- **References:** [links]

## Threat Model Summary
[Link to STRIDE table from Phase 2]

## Dependency Summary
[Known CVEs, outdated packages, license risks]

## Remediation Roadmap
1. **Immediate (0-7 days):** [critical/high fixes]
2. **Short-term (1-4 weeks):** [medium fixes]
3. **Long-term:** [architecture improvements]

## Checklist Coverage
See [audit-checklists](../audit-checklists/SKILL.md) — note unchecked items.
```

## Severity Ratings

| Level | Criteria |
|-------|----------|
| **Critical** | Remote code execution, auth bypass, mass data breach, active exploitation |
| **High** | SQLi/XSS with impact, privilege escalation, secret exposure |
| **Medium** | Missing security controls, CSRF on sensitive actions, weak crypto |
| **Low** | Defense-in-depth gaps, verbose errors, missing headers |
| **Info** | Best practice deviations, hardening opportunities |

## Additional Resources

- Checklists: [audit-checklists](../audit-checklists/SKILL.md)
- Threat models: [threat-modeling](../threat-modeling/SKILL.md)
- Framework checks: [framework-security-checks](../framework-security-checks/SKILL.md)
- OWASP: [owasp-javascript](../owasp-javascript/SKILL.md)
- Dependencies: [dependency-audit](../dependency-audit/SKILL.md)
- Supply chain: [supply-chain-security](../supply-chain-security/SKILL.md)
- Bug reports: [security-bug-reporting](../security-bug-reporting/SKILL.md)