majiayu000 Security Audit
Perform a comprehensive security review using OWASP Top 10 as a framework.
Scope
Target: $ARGUMENTS (or entire codebase if not specified)
Checklist
A01 — Broken Access Control
- Authorization checks on every protected route/endpoint
- Horizontal privilege escalation (can user A access user B's data?)
- IDOR (insecure direct object references) in API endpoints
- Missing authentication middleware
A02 — Cryptographic Failures
- Sensitive data stored/transmitted in plaintext
- Weak hash algorithms (MD5, SHA1 for passwords)
- Hardcoded secrets, API keys, or passwords in source
- TLS not enforced in production config
A03 — Injection
- SQL injection (raw queries with user input)
- Command injection (shell exec with user data)
- XSS (unsanitized HTML output)
- LDAP, NoSQL, XML injection
A04 — Insecure Design
- Missing rate limiting on auth endpoints
- No brute-force protection on login
- Sensitive operations lack confirmation step
A05 — Security Misconfiguration
- Debug mode enabled in production config
- Verbose error messages exposing internals
- Default credentials not changed
- Unnecessary services/ports exposed
- Missing security headers (CSP, HSTS, X-Frame-Options)
A06 — Vulnerable Components
npm audit
# or: pip-audit / safety check / snyk test
A07 — Authentication Failures
- Weak password policy
- Session tokens not invalidated on logout
- Missing MFA for sensitive operations
- JWT: algorithm confusion, weak secret, no expiry
A08 — Software Integrity Failures
- Subresource Integrity (SRI) for external scripts
- CI/CD pipeline integrity
A09 — Logging Failures
- Sensitive data logged (passwords, tokens, PII)
- Failed auth attempts not logged
- No audit trail for admin actions
A10 — Server-Side Request Forgery (SSRF)
- Unvalidated URL parameters used in server requests
- Internal network accessible via user-controlled URLs
Output Format
## Security Audit Report
### Critical (fix immediately)
- [file:line] VULN_TYPE — description + remediation
### High (fix before next release)
- [file:line] VULN_TYPE — description + remediation
### Medium (fix in next sprint)
- [file:line] VULN_TYPE — description
### Low / Informational
- [finding] — recommendation
### Dependency Vulnerabilities
[npm audit / pip-audit output summary]
### Score: X/10 critical issues found
$ARGUMENTS