SuperAPI AI Directory
Partner with us中文AI newsFavorites
Skillscodeguard-security-code

codeguard-security-code

Security & auditing

View repository

Updated 10-15 21:48

About this skill

Code Security Standards (Leaks · Configuration · CVEs)

Basis: PartMe.AI Development Security Standards "Code Security Standards". Core principles:Source code and configuration must not be exposed to the public network。

Capability Boundaries

✅ Strengths

  1. The three major check items (code leaks/configuration leaks/CVEs) each have tool-based commands and gate thresholds
  2. Unified entry point codeguard cve orchestrates multi-ecosystem scanning

⚠️ Prerequisites

  1. Scanning tools: mvn + dependency-check / npm / pip-audit / cargo audit / trivy (install missing ecosystems as prompted)

❌ Out of Scope

  1. Privilege escalation/authentication/file upload → codeguard-security-api
  2. Encrypted storage/masking/classified protection security assessment → codeguard-security-data

I. Code Leak Check

Check Item Requirement
Git Access Method Must use SSH or HTTPS + credentials; pulling and pushing via plaintext http protocol is prohibited
Public Network Publication Control Source code must not be made public on the public network (including public repositories, cloud drives, and code posted in blogs)
AI Tool Usage Be aware of the code leak risks of AI tools; for sensitive projects, do not send core code to uncontrolled external services

Risk: Code contains business logic interfaces, encryption/decryption methods, authentication methods, and unfixed vulnerabilities; public network exposure equals attack surface.

II. Configuration Leak Check

Check Item Requirement
Repository contains no important configuration Database passwords, Api Keys, and storage keys must not enter the code repository; use environment variables instead
Frontend Use .env.local local variable files (gitignore); important information is returned by backend interfaces
Backend Configuration is placed in a configuration center (such as Nacos); databases, ApiKeys, etc. are stored encrypted

AI behavior:ProhibitedHardcoding keys/passwords into code or committing them; when leaked keys are discovered, immediately prompt for rotation rather than only deletion (they remain in git history).

III. Security Vulnerability (CVE) Check

Requirement: Frontend and backend regularly perform dependency component vulnerability scanning,no medium-risk or higher vulnerabilities。

For tool selection and gate threshold comparison, see references/cve-tools-matrix.md。

Unified entry point (recommended)

First determine the engine:codeguard --version --format json. For comparison, see codeguard skill's references/operations/engine-contract.md。

Legacy Python engine:

codeguard cve                    # 自动检测生态并扫描（maven/node/python/rust）
codeguard cve --fix              # 允许自动修复（npm audit fix）
codeguard cve --severity MEDIUM  # 失败阈值调到中危

The Rust engine uses positional parameters to select the ecosystem, and does not have --fix / --severity; it currently returns incomplete for the quality path (exit code 3) and cannot be used to issue a "no vulnerabilities" conclusion:

codeguard cve typescript [path]   # / cve rust / cve python

Native commands for each ecosystem

# Maven 项目：OWASP dependency-check（pom 配置模板见 linters/maven/dependency-check-pom-snippet.xml）
mvn org.owasp:dependency-check-maven:check -DfailBuildOnCVSS=7
# 检查出漏洞后的修复：
mvn versions:display-dependency-updates       # 查看可升级依赖
mvn versions:use-latest-versions              # 批量升级到最新（谨慎，需回归）

# 前端
npm audit --audit-level=high        # 或 pnpm audit / yarn audit
npm audit fix                        # 自动修复可修复项
# VS Code 安全检查插件定期检查依赖组件

# 通用兜底：trivy（扫一切锁文件与镜像）
trivy fs --scanners vuln --severity HIGH,CRITICAL .

# JetBrains IDE 插件：MurphySec Code Scan（团队推荐）

AI behavior

  • If it is found, it must be fixed: When CVE scanning finds HIGH/CRITICAL, remediation actions must be provided (upgrade version/replace component/register false positive); reporting without handling is not allowed
  • Before upgrading a dependency, first confirm the CVE affected version range to avoid introducing incompatible changes to fix the CVE
  • When upgrade is not possible, provide mitigation measures (such as WAF rules, closing exposed surfaces) and register the reason in the dependency suppression file
  • For false positives, go to dependency-check-suppressions.xml Register and document the basis,Prohibitedto silently raise the threshold in order to pass the gate
  • Scan report requirement: passing requires no medium-risk or higher vulnerabilities

IV. Checklist (self-check at the end of an AI session)

  • This change has not added any hardcoded keys/passwords/internal network addresses
  • New dependencies have not introduced HIGH/CRITICAL CVEs (confirmed with the above tools)
  • .env / configuration files have not been added to git (confirm .gitignore covers them)
  • No internal repository code has been pushed to a public repository

Out of scope (when not to use it)

  • The problem is only lint/formatting, or it only requires running multi-ecosystem CVE commands; the corresponding dedicated skill should be used.
  • Requires active attacks/penetration testing against unauthorized repositories, systems, or production networks.
  • Requires fully echoing keys, tokens, or personal data in the report.

Standard Workflow

Step 1: Confirm authorization and boundaries

Determine which repositories, history, submodules, build artifacts, and external systems can be scanned.

Step 2: Perform read-only discovery

Separately inspect the current working tree, Git history, configuration templates, lock files, and release artifacts.

Step 3: Immediately limit the leak

For leaked credentials, first revoke/rotate them and check usage logs, then remove them from files and history.

Step 4: Remediate and regress

Migrate secrets to a managed secret store, update references and documentation, and run regression tests for dependency upgrades.

Step 5: Rescan and retain residual risk

Rerun the original scan and clearly distinguish items that are rotated, removed, mitigated, suppressed, and unresolved.

Rules

  1. When credentials are found, report the type and location without echoing the full value.
  2. Deleting the current file does not mean copies in Git history, caches, images, or logs have disappeared.
  3. Suppression must include the basis, scope, owner, and expiration date.
  4. Do not conduct active attacks against unauthorized assets or expand the scan.

Gotchas

  1. base64 is not encryption, and cannot be used to protect keys.
  2. Frontend environment variables can be bundled into the browser, so secrets carried into a bundle are considered public.
  3. Cleaning Git history rewrites SHAs, requiring separate authorization and a collaboration plan.
  4. Test fixtures may also contain real credentials, and should not be ignored just because they are in a test directory.
  5. Zero findings by a security scanner is not complete proof, and the rule version and scan scope need to be documented.
  6. Call logs for old credentials are important, and after rotation you must still investigate abuse during the exposure period.

Load resources on demand

  • When selecting CVE tools, read references/cve-tools-matrix.md。
  • For decisions and handoffs, read references/rules/decision-contract.md and references/operations/evidence-playbook.md。
  • Open only examples/ examples that match the current incident.