Source Code Security Review
Quick Start
- Identify - languages, frameworks, package managers present
- Automated SAST - run tools appropriate to the stack
- Dependency CVEs - scan lockfiles/manifests for known CVEs
- Secrets scan - detect hardcoded credentials/tokens
- Manual review - trace high-risk sinks (exec, eval, query, deserialize)
- Malicious code - check for backdoors, obfuscation, suspicious network calls
- Report - findings with CWE/CVE refs, severity, PoC, remediation
Workflow
Phase 1: Enumerate
- Languages: ls **/*.{py,js,ts,java,go,rb,php,cs,rs}
- Packages: find package.json, requirements.txt, go.mod, pom.xml, Gemfile, composer.json, Cargo.toml
- Entry points: main(), index.*, app.*, server.*
- Config files: .env*, config.*, settings.*, *.yaml, *.toml
Phase 2: Automated SAST
See sast-tools.md for commands per language.
Key tools:
- Multi-language: Semgrep (
semgrep --config=auto .)
- Python: Bandit (
bandit -r . -f json)
- JavaScript/TS: ESLint security plugin, njsscan
- Java: SpotBugs + FindSecBugs
- Go: gosec (
gosec ./...)
- PHP: PHPCS Security Audit
- Ruby: Brakeman (
brakeman -o report.json)
- All: CodeQL (via
gh codeql)
Phase 3: Dependency CVE Scan
See dependency-cve-scanning.md for commands.
| Ecosystem |
Command |
| npm/yarn |
npm audit --json / yarn audit |
| Python |
pip-audit -r requirements.txt |
| Java |
dependency-check --scan . |
| Go |
govulncheck ./... |
| Ruby |
bundle audit |
| Generic |
trivy fs . / grype dir:. |
Phase 4: Secrets Detection
See secrets-detection.md.
trufflehog filesystem . --json
gitleaks detect --source . -v
Phase 5: Manual Review
Focus on high-risk sinks — see manual-review.md:
- Injection sinks:
exec, eval, query, system, popen
- Deserialization:
pickle.loads, ObjectInputStream, unserialize
- Crypto: hardcoded keys, weak algorithms (MD5, SHA1, DES, ECB)
- Auth: JWT validation, session management, RBAC enforcement
- File ops: path construction with user input
Phase 6: Malicious Code
See malicious-code.md:
- Obfuscated strings (base64, hex, charCode)
- Unexpected network calls in library code
- Typosquatting indicators
- Postinstall/lifecycle script abuse
- Hidden backdoors in dependencies
Language-Specific Patterns
See language-patterns.md for Python, JS, Java, Go, PHP, Ruby.
Severity Mapping
| Severity |
CVSS |
Examples |
| Critical |
9.0+ |
RCE, SQLi with exfil, auth bypass |
| High |
7.0-8.9 |
Stored XSS, SSRF, insecure deserialization |
| Medium |
4.0-6.9 |
Reflected XSS, info disclosure, IDOR |
| Low |
0.1-3.9 |
Missing headers, verbose errors |
Output Format
findings/
<severity>-<vuln-type>-<location>.md # One file per finding
evidence/
<tool>-output.json # Raw tool output
summary-report.md # Executive summary
Each finding: CWE/CVE ID | File:Line | Severity | PoC | Remediation
Mobile App Analysis (APK/IPA)
When given a mobile app binary:
- Extract:
unzip app.apk -d extracted/ (APKs are ZIP archives)
- Identify framework: React Native (
assets/index.android.bundle), Flutter (libflutter.so), Xamarin, or native
- React Native: JS bundle is plaintext — search for secrets, API keys, config objects, hardcoded tokens
- Encoded secrets: Search for base64 prefixes of known flag/secret formats (e.g.,
RkxBR = base64 of FLAG). Config objects often store secrets as base64 in debug, secret, apiKey fields
- Native: Use
jadx for Java/Kotlin decompilation, check AndroidManifest.xml, strings.xml, BuildConfig
- Shared libs: Check
.so files with strings for hardcoded credentials
Critical Rules
- Never execute untrusted code during review
- Treat all findings as potential until verified
- Always cross-reference CVEs against actual version in use
- Report supply chain issues separately (they affect all users)
1---2name: source-code-scanning3description: Security-focused source code review and SAST. Scans for vulnerabilities (OWASP Top 10, CWE Top 25), CVEs in third-party dependencies/packages, hardcoded secrets, malicious code, and insecure patterns. Use when given source code, a repo path, or asked to "audit", "scan", "review" code security, or "check dependencies for CVEs".4---5
6# Source Code Security Review
7
8## Quick Start
9
101. **Identify** - languages, frameworks, package managers present
112. **Automated SAST** - run tools appropriate to the stack
123. **Dependency CVEs** - scan lockfiles/manifests for known CVEs
134. **Secrets scan** - detect hardcoded credentials/tokens
145. **Manual review** - trace high-risk sinks (exec, eval, query, deserialize)
156. **Malicious code** - check for backdoors, obfuscation, suspicious network calls
167. **Report** - findings with CWE/CVE refs, severity, PoC, remediation
17
18## Workflow
19
20### Phase 1: Enumerate
21```
22- Languages: ls **/*.{py,js,ts,java,go,rb,php,cs,rs}
23- Packages: find package.json, requirements.txt, go.mod, pom.xml, Gemfile, composer.json, Cargo.toml
24- Entry points: main(), index.*, app.*, server.*
25- Config files: .env*, config.*, settings.*, *.yaml, *.toml
26```
27
28### Phase 2: Automated SAST
29See [sast-tools.md](reference/sast-tools.md) for commands per language.
30
31Key tools:
32- **Multi-language**: Semgrep (`semgrep --config=auto .`)
33- **Python**: Bandit (`bandit -r . -f json`)
34- **JavaScript/TS**: ESLint security plugin, njsscan
35- **Java**: SpotBugs + FindSecBugs
36- **Go**: gosec (`gosec ./...`)
37- **PHP**: PHPCS Security Audit
38- **Ruby**: Brakeman (`brakeman -o report.json`)
39- **All**: CodeQL (via `gh codeql`)
40
41### Phase 3: Dependency CVE Scan
42See [dependency-cve-scanning.md](reference/dependency-cve-scanning.md) for commands.
43
44| Ecosystem | Command |
45|---|---|
46| npm/yarn | `npm audit --json` / `yarn audit` |
47| Python | `pip-audit -r requirements.txt` |
48| Java | `dependency-check --scan .` |
49| Go | `govulncheck ./...` |
50| Ruby | `bundle audit` |
51| Generic | `trivy fs .` / `grype dir:.` |
52
53### Phase 4: Secrets Detection
54See [secrets-detection.md](reference/secrets-detection.md).
55```bash
56trufflehog filesystem . --json
57gitleaks detect --source . -v
58```
59
60### Phase 5: Manual Review
61Focus on high-risk sinks — see [manual-review.md](reference/manual-review.md):
62- Injection sinks: `exec`, `eval`, `query`, `system`, `popen`
63- Deserialization: `pickle.loads`, `ObjectInputStream`, `unserialize`
64- Crypto: hardcoded keys, weak algorithms (MD5, SHA1, DES, ECB)
65- Auth: JWT validation, session management, RBAC enforcement
66- File ops: path construction with user input
67
68### Phase 6: Malicious Code
69See [malicious-code.md](reference/malicious-code.md):
70- Obfuscated strings (base64, hex, charCode)
71- Unexpected network calls in library code
72- Typosquatting indicators
73- Postinstall/lifecycle script abuse
74- Hidden backdoors in dependencies
75
76## Language-Specific Patterns
77See [language-patterns.md](reference/language-patterns.md) for Python, JS, Java, Go, PHP, Ruby.
78
79## Severity Mapping
80
81| Severity | CVSS | Examples |
82|---|---|---|
83| Critical | 9.0+ | RCE, SQLi with exfil, auth bypass |
84| High | 7.0-8.9 | Stored XSS, SSRF, insecure deserialization |
85| Medium | 4.0-6.9 | Reflected XSS, info disclosure, IDOR |
86| Low | 0.1-3.9 | Missing headers, verbose errors |
87
88## Output Format
89
90```
91findings/
92 <severity>-<vuln-type>-<location>.md # One file per finding
93evidence/
94 <tool>-output.json # Raw tool output
95summary-report.md # Executive summary
96```
97
98Each finding: CWE/CVE ID | File:Line | Severity | PoC | Remediation
99
100## Mobile App Analysis (APK/IPA)
101
102When given a mobile app binary:
1031. **Extract**: `unzip app.apk -d extracted/` (APKs are ZIP archives)
1042. **Identify framework**: React Native (`assets/index.android.bundle`), Flutter (`libflutter.so`), Xamarin, or native
1053. **React Native**: JS bundle is plaintext — search for secrets, API keys, config objects, hardcoded tokens
1064. **Encoded secrets**: Search for base64 prefixes of known flag/secret formats (e.g., `RkxBR` = base64 of `FLAG`). Config objects often store secrets as base64 in `debug`, `secret`, `apiKey` fields
1075. **Native**: Use `jadx` for Java/Kotlin decompilation, check `AndroidManifest.xml`, `strings.xml`, `BuildConfig`
1086. **Shared libs**: Check `.so` files with `strings` for hardcoded credentials
109
110## Critical Rules
111- Never execute untrusted code during review
112- Treat all findings as potential until verified
113- Always cross-reference CVEs against actual version in use
114- Report supply chain issues separately (they affect all users)
transilienceai