# QA Security Auditor

> Security and QA auditing workflow for QoreDB. Use when the user asks to "check security", "audit code", or before merging critical features. Checks for sensitive data leaks, dangerous permissions, and unsafe SQL patterns. Use when this capability is needed.

- Skill: `tomevault-io/qa-security-auditor` (Agent Skill, multi-file: 2 files)
- Install (CLI): `npx skillmds@latest add tomevault-io/qa-security-auditor`
- Raw SKILL.md: https://api.skillmd.com/api/skills/tomevault-io/qa-security-auditor/raw
- Safety review: pending (external: skill-scanner PASS, skillspector PASS)
- Works with: Claude Code, Claude.ai, OpenAI Codex
- Category: Data & Analytics
- Author: tomevault-io (https://skillmd.com/u/tomevault-io)
- Updated: 2026-09-17
- Page: https://skillmd.com/skills/tomevault-io/qa-security-auditor

---


# QA & Security Auditor

This skill performs a security and quality audit of the codebase, focusing on the specific risks of a desktop database client.

## Audit Checklist

### 1. Sensitive Data Exposure (Logs)

**Risk**: Credentials appearing in logs.

- [ ] Search for `console.log`, `println!`, `dbg!` containing "password", "secret", "key", "token".
- [ ] Verify that connection strings are redacted before logging.

### 2. Dangerous Operations

**Risk**: Accidental data loss.

- [ ] Verify that any Rust command calling `drop_database`, `delete_row`, or `truncate` checks the `SafetyPolicy`.
- [ ] Ensure the frontend invokes a confirmation modal (e.g., `useDoubleCheck`) before calling these commands.

### 3. Tauri Permissions (`src-tauri/capabilities/`)

**Risk**: Excessive system access.

- [ ] Check `default.json` or `base.json`.
- [ ] Ensure `fs` scope is limited (no `$HOME/*` unless absolutely necessary).
- [ ] Ensure `shell` scope doesn't allow arbitrary command execution.

### 4. SQL Injection / NoSQL Injection

**Risk**: Malicious queries.

- [ ] Rust: Ensure `query` arguments are bound parameters, not string concatenation (e.g. `format!("SELECT * FROM {}", table)` is dangerous).
- [ ] Rust: For dynamic table names, ensure validation/escaping via `sql_safety.rs`.

## Workflow

1.  **Run Pattern Search**: Use `grep_search` to find `console.log` or `println!` in modified files.
2.  **Verify Policy Checks**: Read the relevant Rust command file. Does it import `SafetyPolicy`? Does it call `policy.check(...)`?
3.  **Check Permissions**: Read `src-tauri/capabilities/default.json` if new filesystem features were added.

## Common Fixes

**Redacting Logs (Rust):**

```rust
// BAD
println!("Connecting to {}", password);

// GOOD
info!("Connecting to database with user {}", user); // standard log without secrets
```

**Checking Safety (Rust):**

```rust
// BAD
pub async fn drop_table(...) {
    engine.execute("DROP TABLE ...").await;
}

// GOOD
pub async fn drop_table(state: State<'_, AppState>, ...) {
    state.policy.enforce_dangerous_action()?; // Returns error if not confirmed/allowed
    engine.execute("DROP TABLE ...").await;
}
```

---
> Converted and distributed by [TomeVault](https://tomevault.io/claim/qoredb) — claim your Tome and manage your conversions.
<!-- tomevault:4.0:skill_md:2026-04-11 -->