# Security Scan

> Proactive security scanning. Triggers when modifying auth, API endpoints, user data, or sensitive operations.

- Skill: `majiayu000/security-scan` (Agent Skill, multi-file: 2 files)
- Install (CLI): `npx skillmds add majiayu000/security-scan`
- Raw SKILL.md: https://api.skillmd.com/api/skills/majiayu000/security-scan/raw
- Safety review: pending
- Works with: Claude Code, Claude.ai, OpenAI Codex
- Category: Security
- Author: majiayu000 (https://skillmd.com/u/majiayu000)
- Updated: 2026-09-09
- Page: https://skillmd.com/skills/majiayu000/security-scan

---


# Security Scan Skill

Automatically scans for security issues when security-sensitive code is modified.

## When to Activate

This skill should activate when:
- Changes touch authentication or authorization
- New API endpoints are added
- User input handling is modified
- Database queries are added/modified
- File uploads or storage operations
- Payment or financial operations

## Security Checklist

### 1. Authentication & Authorization
- [ ] Auth middleware applied to protected routes
- [ ] Firebase Auth tokens properly validated
- [ ] User can only access their own data
- [ ] Admin endpoints properly restricted

### 2. Input Validation
- [ ] All user inputs validated
- [ ] Request body size limits
- [ ] File upload type/size restrictions
- [ ] Path traversal prevention

### 3. Data Protection
- [ ] No sensitive data in logs
- [ ] No secrets in code
- [ ] PII properly handled
- [ ] Signed URLs used for private files

### 4. API Security
- [ ] Rate limiting considered
- [ ] CORS properly configured
- [ ] Error messages don't leak info
- [ ] Proper HTTP status codes

### 5. Firebase/Firestore Security
- [ ] Security rules updated for new collections
- [ ] Rules tested with Firebase emulator
- [ ] No wildcard read/write rules
- [ ] Proper field-level validation

## OWASP Top 10 Quick Check

1. **Injection** - Parameterized queries?
2. **Broken Auth** - Session management secure?
3. **Sensitive Data** - Encrypted at rest/transit?
4. **XXE** - XML parsing disabled/secured?
5. **Broken Access Control** - Authorization checked?
6. **Misconfiguration** - Default configs changed?
7. **XSS** - Output encoded?
8. **Deserialization** - Untrusted data validated?
9. **Components** - Dependencies up to date?
10. **Logging** - Security events logged?

## Platform-Specific Checks

### Backend (Go)
```bash
# Run security scan
cd backend && make security-scan

# Check for vulnerabilities
cd backend && make vuln-check
```

### Web (Next.js)
```bash
# Check npm vulnerabilities
cd web && npm audit

# Check for secrets
grep -r "api_key\|secret\|password" web/src/
```

## Output Format

```markdown
## Security Scan Results

### Critical Vulnerabilities
- [Immediate action required]

### High Risk Issues
- [Should be fixed before deploy]

### Medium Risk Issues
- [Should be addressed soon]

### Recommendations
- [Security best practices]
```

## Reference

See `docs/SECURITY.md` for detailed security requirements.