Security Scan
Automated security audit for the project. Checks dependencies for known vulnerabilities, scans for hardcoded secrets, and reviews code against OWASP guidelines.
1. Detect Project Stack
Read CLAUDE.md and project config to determine:
- Language(s) and dependency managers
- Infrastructure (Docker, Kubernetes, Terraform)
- Existing security tools (Snyk, Trivy, OWASP dependency-check, etc.)
2. Dependency Audit
Run the project's dependency vulnerability scanner:
| Stack |
Command |
| Node.js (npm) |
npm audit |
| Node.js (pnpm) |
pnpm audit |
| Node.js (yarn) |
yarn audit |
| Python (pip) |
pip-audit or safety check |
| Python (poetry) |
poetry audit or pip-audit |
| Java (Maven) |
mvn org.owasp:dependency-check-maven:check |
| Java (Gradle) |
gradle dependencyCheckAnalyze |
| Go |
govulncheck ./... |
| .NET |
dotnet list package --vulnerable |
| Docker |
trivy image <image-name> or docker scout cves |
Classify findings by severity:
| Severity |
Action |
| Critical / High |
Must fix before merge. Upgrade dependency or apply workaround |
| Medium |
Should fix. Schedule if no immediate upgrade available |
| Low |
Track. Fix in next maintenance cycle |
3. Secrets Scan
Scan the codebase for hardcoded secrets:
// turbo
git log --diff-filter=A --name-only --pretty=format: | sort -u
Check for common secret patterns in source files:
- API keys (AWS, GCP, GitHub, Slack)
- Private keys (RSA, EC, SSH)
- Connection strings with credentials
- JWT tokens and bearer tokens
- Passwords in config files
Tools (if available):
gitleaks detect --source .trufflehog filesystem .detect-secrets scan
4. OWASP Top 10 Review
Manual code review against OWASP Top 10 (2021):
| # |
Risk |
What to Check |
| A01 |
Broken Access Control |
Authorization checks on every endpoint, CORS policy, directory traversal |
| A02 |
Cryptographic Failures |
TLS enforcement, password hashing, data encryption, no weak algorithms |
| A03 |
Injection |
SQL/NoSQL/OS command injection, parameterized queries, input validation |
| A04 |
Insecure Design |
Threat model, rate limiting, business logic flaws |
| A05 |
Security Misconfiguration |
Default credentials, debug mode, unnecessary features, error messages |
| A06 |
Vulnerable Components |
Dependency audit results (Step 2) |
| A07 |
Auth Failures |
Brute force protection, session management, MFA |
| A08 |
Data Integrity Failures |
CI/CD pipeline security, deserialization, update verification |
| A09 |
Logging Failures |
Security event logging, no PII in logs, monitoring |
| A10 |
SSRF |
Server-side request validation, allowlists for external calls |
Use code-review skill's security-checklist.md for detailed checks.
5. Infrastructure Security (if applicable)
Docker
- Base images from trusted registries
- No
latest tag — pinned versions
- Non-root user in container
- No secrets in Dockerfile or image layers
- Minimal base image (distroless/alpine)
Kubernetes
- Pods run as non-root with read-only filesystem
- Network policies restrict traffic
- Secrets in Kubernetes Secrets or external vault
- Resource limits set on all containers
- RBAC follows least-privilege
Terraform
- No hardcoded credentials in
.tf files
- State file encrypted and access-controlled
- Security groups follow least-privilege
- Encryption enabled for storage and databases
6. Report
## Security Scan Report
### Summary
- **Risk level**: LOW / MEDIUM / HIGH / CRITICAL
- **Scan date**: [date]
- **Scope**: [what was scanned]
### Dependency Vulnerabilities
| Package | Current | Fixed In | Severity | CVE |
|---------|---------|----------|----------|-----|
| [pkg] | [ver] | [ver] | [sev] | [id]|
### Secrets Found
- [ ] [file:line] — [type of secret] — **ACTION: Remove and rotate**
### OWASP Findings
| Risk | Status | Details |
|------|--------|---------|
| A01 Access Control | ✅/❌ | [details] |
| A02 Crypto | ✅/❌ | [details] |
| ... | ... | ... |
### Infrastructure
- Docker: [pass/fail/N/A]
- Kubernetes: [pass/fail/N/A]
- Terraform: [pass/fail/N/A]
### Recommended Actions
1. **Critical**: [action] — [deadline]
2. **High**: [action] — [deadline]
3. **Medium**: [action] — [schedule]
Integration
- Called by:
/code-review (security layer), /pre-commit (optional)
- Roles:
Agent(software-engineer) (security focus), Agent(devops-engineer) (infra scan), Agent(devops-architect) (supply chain security, GHAS, SBOM/SLSA)
- Skills:
code-review skill (security checklist)
1---2name: security-scan-53description: Security scan workflow — dependency audit, OWASP checklist, secrets scan, vulnerability report. Applies software-engineer role with security focus. Use standalone or as part of code review.4---5
6# Security Scan
7
8Automated security audit for the project. Checks dependencies for known vulnerabilities, scans for hardcoded secrets, and reviews code against OWASP guidelines.
9
10## 1. Detect Project Stack
11
12Read `CLAUDE.md` and project config to determine:
13
14- **Language(s)** and dependency managers
15- **Infrastructure** (Docker, Kubernetes, Terraform)
16- **Existing security tools** (Snyk, Trivy, OWASP dependency-check, etc.)
17
18## 2. Dependency Audit
19
20Run the project's dependency vulnerability scanner:
21
22| Stack | Command |
23|---|---|
24| Node.js (npm) | `npm audit` |
25| Node.js (pnpm) | `pnpm audit` |
26| Node.js (yarn) | `yarn audit` |
27| Python (pip) | `pip-audit` or `safety check` |
28| Python (poetry) | `poetry audit` or `pip-audit` |
29| Java (Maven) | `mvn org.owasp:dependency-check-maven:check` |
30| Java (Gradle) | `gradle dependencyCheckAnalyze` |
31| Go | `govulncheck ./...` |
32| .NET | `dotnet list package --vulnerable` |
33| Docker | `trivy image <image-name>` or `docker scout cves` |
34
35Classify findings by severity:
36
37| Severity | Action |
38|---|---|
39| **Critical / High** | Must fix before merge. Upgrade dependency or apply workaround |
40| **Medium** | Should fix. Schedule if no immediate upgrade available |
41| **Low** | Track. Fix in next maintenance cycle |
42
43## 3. Secrets Scan
44
45Scan the codebase for hardcoded secrets:
46
47```
48// turbo
49git log --diff-filter=A --name-only --pretty=format: | sort -u
50```
51
52Check for common secret patterns in source files:
53- API keys (AWS, GCP, GitHub, Slack)
54- Private keys (RSA, EC, SSH)
55- Connection strings with credentials
56- JWT tokens and bearer tokens
57- Passwords in config files
58
59**Tools** (if available):
60- `gitleaks detect --source .`
61- `trufflehog filesystem .`
62- `detect-secrets scan`
63
64## 4. OWASP Top 10 Review
65
66Manual code review against OWASP Top 10 (2021):
67
68| # | Risk | What to Check |
69|---|---|---|
70| A01 | Broken Access Control | Authorization checks on every endpoint, CORS policy, directory traversal |
71| A02 | Cryptographic Failures | TLS enforcement, password hashing, data encryption, no weak algorithms |
72| A03 | Injection | SQL/NoSQL/OS command injection, parameterized queries, input validation |
73| A04 | Insecure Design | Threat model, rate limiting, business logic flaws |
74| A05 | Security Misconfiguration | Default credentials, debug mode, unnecessary features, error messages |
75| A06 | Vulnerable Components | Dependency audit results (Step 2) |
76| A07 | Auth Failures | Brute force protection, session management, MFA |
77| A08 | Data Integrity Failures | CI/CD pipeline security, deserialization, update verification |
78| A09 | Logging Failures | Security event logging, no PII in logs, monitoring |
79| A10 | SSRF | Server-side request validation, allowlists for external calls |
80
81Use `code-review` skill's `security-checklist.md` for detailed checks.
82
83## 5. Infrastructure Security (if applicable)
84
85### Docker
86- Base images from trusted registries
87- No `latest` tag — pinned versions
88- Non-root user in container
89- No secrets in Dockerfile or image layers
90- Minimal base image (distroless/alpine)
91
92### Kubernetes
93- Pods run as non-root with read-only filesystem
94- Network policies restrict traffic
95- Secrets in Kubernetes Secrets or external vault
96- Resource limits set on all containers
97- RBAC follows least-privilege
98
99### Terraform
100- No hardcoded credentials in `.tf` files
101- State file encrypted and access-controlled
102- Security groups follow least-privilege
103- Encryption enabled for storage and databases
104
105## 6. Report
106
107```
108## Security Scan Report
109
110### Summary
111- **Risk level**: LOW / MEDIUM / HIGH / CRITICAL
112- **Scan date**: [date]
113- **Scope**: [what was scanned]
114
115### Dependency Vulnerabilities
116| Package | Current | Fixed In | Severity | CVE |
117|---------|---------|----------|----------|-----|
118| [pkg] | [ver] | [ver] | [sev] | [id]|
119
120### Secrets Found
121- [ ] [file:line] — [type of secret] — **ACTION: Remove and rotate**
122
123### OWASP Findings
124| Risk | Status | Details |
125|------|--------|---------|
126| A01 Access Control | ✅/❌ | [details] |
127| A02 Crypto | ✅/❌ | [details] |
128| ... | ... | ... |
129
130### Infrastructure
131- Docker: [pass/fail/N/A]
132- Kubernetes: [pass/fail/N/A]
133- Terraform: [pass/fail/N/A]
134
135### Recommended Actions
1361. **Critical**: [action] — [deadline]
1372. **High**: [action] — [deadline]
1383. **Medium**: [action] — [schedule]
139```
140
141## Integration
142
143- **Called by**: `/code-review` (security layer), `/pre-commit` (optional)
144- **Roles**: `Agent(software-engineer)` (security focus), `Agent(devops-engineer)` (infra scan), `Agent(devops-architect)` (supply chain security, GHAS, SBOM/SLSA)
145- **Skills**: `code-review` skill (security checklist)
majiayu000