bitlysis-security-audit

Bitlysis — Security Audit & Best Practices

When to Use

• Reviewing authentication or authorization implementations
• Auditing API endpoints for security vulnerabilities
• Reviewing smart contracts before deployment
• Checking for OWASP Top 10 vulnerabilities
• Pre-production security review
• Dependency vulnerability scanning

Instructions

Step 1: Authentication & Authorization

// ✅ Use getUser() not getSession() for server-side auth (prevents CSRF)
import { createClient } from "@/lib/supabase/server";

export async function getAuthenticatedUser() { const supabase = await createClient(); const { data: { user }, error } = await supabase.auth.getUser(); if (error || !user) throw new UnauthorizedError(); return user; }

// ✅ Row-Level Security (RLS) must be enabled on all user-data tables // ❌ Never bypass RLS with service_role key in client-facing code

### Step 2: Input Validation Checklist

For every API endpoint, verify:

- [ ] **Request body** validated with Pydantic (Python) or Zod (TypeScript)
- [ ] **Path parameters** type-validated (no raw string coercion to DB queries)
- [ ] **File uploads**: MIME type check, size limit, virus scan consideration
- [ ] **SQL injection**: use ORM parameterized queries only, never string interpolation
- [ ] **XSS**: sanitize any HTML content with DOMPurify before rendering

```python
# ✅ Correct: Pydantic validates and coerces types
class UserQuery(BaseModel):
    user_id: UUID  # auto-validates UUID format
    limit: int = Field(default=10, ge=1, le=100)

# ❌ Wrong: raw string in query
cursor.execute(f"SELECT * FROM users WHERE id = {user_id}")  # SQL injection risk

Step 3: Secrets & Credentials

# Run secret scanning before every commit
# Install: pip install detect-secrets
detect-secrets scan --all-files

# Check for exposed keys in git history
git log --all --full-history -- "**/*.env*"

Checklist:

• No secrets in code, comments, or commit history
• .env.example documents all required variables with placeholder values
• Production secrets in platform secrets manager (Vercel, Render, Doppler)
• API keys rotated if accidentally exposed

Step 4: Security Headers

// next.config.ts
const securityHeaders = [
  { key: "X-DNS-Prefetch-Control", value: "on" },
  { key: "X-Frame-Options", value: "SAMEORIGIN" },
  { key: "X-Content-Type-Options", value: "nosniff" },
  { key: "Referrer-Policy", value: "strict-origin-when-cross-origin" },
  { key: "Permissions-Policy", value: "camera=(), microphone=(), geolocation=()" },
  {
    key: "Content-Security-Policy",
    value: "default-src 'self'; script-src 'self' 'unsafe-inline'; ...",
  },
];

Step 5: Smart Contract Security (if applicable)

// Apply ALL of these patterns for DeFi contracts:

// ✅ 1. Checks-Effects-Interactions pattern
function withdraw(uint256 amount) external nonReentrant {
    require(balances[msg.sender] >= amount, "Insufficient balance"); // CHECK
    balances[msg.sender] -= amount;                                   // EFFECT
    (bool ok,) = msg.sender.call{value: amount}("");                  // INTERACTION
    require(ok, "Transfer failed");
}

// ✅ 2. Reentrancy guard
import "@openzeppelin/contracts/utils/ReentrancyGuard.sol";

// ✅ 3. SafeERC20 for token transfers
import "@openzeppelin/contracts/token/ERC20/utils/SafeERC20.sol";
using SafeERC20 for IERC20;

Step 6: Dependency Audit

# JavaScript
pnpm audit --audit-level moderate
npx snyk test

# Python
pip-audit --requirement requirements.txt
safety check

# Check for outdated packages
pnpm outdated
pip list --outdated

Step 7: OWASP Top 10 Quick Check

Risk	Bitlysis Mitigation
A01 Broken Access Control	RLS enabled, getUser() not getSession()
A02 Cryptographic Failures	HTTPS only, no secrets in code
A03 Injection	Pydantic + Drizzle parameterized queries
A05 Security Misconfiguration	Security headers, CSP
A06 Vulnerable Components	pnpm audit + pip-audit in CI
A07 Auth Failures	JWT rotation, secure session handling
A09 Security Logging	Structured logs with trace_id

Output Format

Security review report:

1. Critical findings (must fix before deploy)
2. High findings (fix within 1 sprint)
3. Medium findings (scheduled fix)
4. Low/Informational (document and monitor)

Activate Specialist

@.cursor/.agents/.agents/security-auditor.md