winsorllc Security Audit
Scan code for security vulnerabilities and secrets. Detects exposed API keys, passwords, insecure patterns, and common vulnerabilities.
Setup
No additional setup required.
Usage
Scan for Secrets
{baseDir}/security-audit.js --scan --path /path/to/code
Check for Vulnerabilities
{baseDir}/security-audit.js --vulns --path /path/to/code
Full Audit
{baseDir}/security-audit.js --full --path /path/to/code
Options
| Option | Description | Required |
|---|---|---|
--scan |
Scan for secrets | No |
--vulns |
Check for vulnerabilities | No |
--full |
Full security audit | No |
--path |
Path to scan | Yes |
--output |
Output format (json, text) | No |
Detected Patterns
Secrets
- AWS keys:
AKIA... - GitHub tokens:
ghp_...,gho_... - Generic API keys
- Private keys (RSA, DSA, EC)
- Database connection strings
- JWT tokens
Vulnerabilities
- SQL injection patterns
- Command injection patterns
- Path traversal
- Hardcoded passwords
- Weak cryptographic algorithms
- Insecure random
Output Format
{
"secrets": [
{
"file": "config.js",
"line": 10,
"type": "api_key",
"context": "apiKey = '..."
}
],
"vulnerabilities": [
{
"file": "app.js",
"line": 25,
"type": "sql_injection",
"message": "Potential SQL injection"
}
]
}
When to Use
- Pre-commit security checks
- CI/CD security scanning
- Code review assistance
- Detecting accidental secret exposure