# Security Audit

> Security review checklist for code and infrastructure

- Skill: `vinilana/security-audit-2` (Agent Skill)
- Install (CLI): `npx skillmds@latest add vinilana/security-audit-2`
- Raw SKILL.md: https://api.skillmd.com/api/skills/vinilana/security-audit-2/raw
- Safety review: pending
- Works with: Claude Code, Claude.ai, OpenAI Codex
- Category: Security
- Author: vinilana (https://skillmd.com/u/vinilana)
- Updated: 2026-09-22
- Page: https://skillmd.com/skills/vinilana/security-audit-2

---


# Security Audit

## When to Use
Activate this skill when performing a security review of code changes or the overall application. Use it for pre-release audits, PR security checks, or periodic security assessments.

## Instructions

### Authentication & Authorization
- [ ] All `/api/*` endpoints require valid Clerk JWT token.
- [ ] Express uses `clerkMiddleware()` from `@clerk/express`.
- [ ] NestJS uses `ClerkAuthGuard` applied globally via `APP_GUARD`.
- [ ] Frontend middleware protects `/dashboard/*` and `/franchises/*` routes.
- [ ] Token is validated for expiration (`exp` claim).
- [ ] **Known issue**: NestJS `ClerkAuthGuard` does not verify JWT signature — uses base64 decode only. Flag for production fix.

### SQL Injection Prevention
- [ ] All SQL queries use parameterized statements (`?` placeholders with `better-sqlite3`).
- [ ] No string concatenation or template literals in SQL queries.
- [ ] User input never inserted directly into SQL strings.

### Secrets Management
- [ ] `.env` files are listed in `.gitignore`.
- [ ] `*.db` database files are excluded from version control.
- [ ] No hardcoded API keys, secrets, or credentials in source code.
- [ ] `.env.example` files contain only placeholder values.

### Input Validation
- [ ] Required fields validated: `name`, `owner_name`, `email` for franchise creation.
- [ ] `status` field accepts only valid values: `active`, `inactive`, `pending`.
- [ ] `state` field accepts only valid Brazilian state codes from `BRAZILIAN_STATES`.
- [ ] NestJS uses `class-validator` for DTO validation.

### CORS & Headers
- [ ] CORS allows only expected origins (localhost for dev, configured domains for prod).
- [ ] No wildcard `*` CORS in production configuration.
- [ ] Error responses don't leak internal implementation details or stack traces.

### Data Protection
- [ ] Franchise data (emails, phones, addresses) not exposed to unauthenticated users.
- [ ] No sensitive data in frontend source code or browser console logs.
- [ ] Database files stored outside the web root.

### Legacy Project Awareness
- [ ] Security fixes in legacy projects (Express/Next.js) are still required — security issues are always critical.
- [ ] New security features (rate limiting, enhanced validation, etc.) should be implemented in NestJS/SvelteKit only.
- [ ] Audit both active and legacy projects, but prioritize remediation in the active stack (NestJS/SvelteKit).

## Examples

**Finding report format:**

| Severity | Finding | Location | Remediation |
|----------|---------|----------|-------------|
| High | JWT signature not verified | `clerk.guard.ts:10` | Use Clerk SDK's `verifyToken()` instead of manual base64 decode |
| Medium | No rate limiting on API | `index.ts` | Add `express-rate-limit` middleware |
| Low | CORS allows all localhost ports | `index.ts` | Restrict to specific ports in production |