iblai-security-owasp-audit

/iblai-security-owasp-audit

Run a systematic source-code audit against the OWASP Top 10 (2021). Ship concrete findings with file/line references and remediation.

Do NOT write exploits. Every finding ships with a fix.

Step 0: Scope the Audit

1. Identify language, framework, and architecture.
2. Map entry points — routes, API handlers, form processors.
3. Trace data flows — user input -> processing -> storage -> output.
4. Locate authentication and authorization boundaries.

Multi-tenant B2B SaaS (the typical ibl.ai shape) makes A01 and permission-bypass paths the highest-leverage targets — sweep those first.

Audit Checklist

Walk each category. Grep for known sinks, then read flagged files to confirm.

A01: Broken Access Control

• Endpoints/routes missing authorization checks
• IDOR — user-controlled IDs without ownership verification
• Missing CSRF protections on state-changing requests
• Role checks enforced only on the frontend, not server-side
• Grep for: direct object references, missing auth middleware, user ID pulled from request params

A02: Cryptographic Failures

• Hardcoded secrets, API keys, or passwords in source
• Weak hashing (MD5, SHA1 for passwords instead of bcrypt/argon2/scrypt)
• Sensitive data in logs, URLs, or localStorage
• Missing encryption at rest or in transit
• Grep for: password, secret, api_key, private_key, MD5, SHA1, base64

A03: Injection

• SQL injection: raw queries with string concatenation, missing parameterized queries
• NoSQL injection: unsanitized user input in MongoDB/Convex queries
• Command injection: exec(), spawn(), system() with user input
• XSS: unescaped user input in HTML, dangerouslySetInnerHTML, v-html
• Template injection: user input in template literals
• Grep for: exec(, eval(, innerHTML, dangerouslySetInnerHTML, $where, raw SQL strings

A04: Insecure Design

• Authentication flows with logic flaws
• Missing rate limiting on sensitive endpoints (login, password reset, API)
• Business-logic constraints enforced only client-side

A05: Security Misconfiguration

• Debug mode enabled in production configs
• Overly permissive CORS (Access-Control-Allow-Origin: *)
• Missing HTTP security headers (CSP, HSTS, X-Frame-Options, X-Content-Type-Options)
• Default credentials or configs shipped
• Verbose error messages leaking stack traces or internals

A06: Vulnerable Components

• Run npm audit (Node), pip audit (Python), or equivalent
• Check lock files for known-vulnerable versions
• Flag dependencies with critical CVEs

A07: Authentication Failures

• Weak password policies
• Session management issues (missing secure/httpOnly flags, no expiry, no rotation)
• Missing rate limiting on login (credential-stuffing risk)
• Broken password reset flows

A08: Data Integrity Failures

• Unsafe deserialization of user input
• Missing integrity checks on CI/CD pipelines
• No lockfile integrity verification (SRI hashes)

A09: Logging & Monitoring Failures

• Auth events not logged (login, failure, privilege changes)
• Sensitive data written to logs (passwords, tokens, PII)
• No alerting on suspicious patterns

A10: SSRF

• User-controlled URLs passed to server-side HTTP requests
• Missing URL validation and allowlisting
• Grep for: fetch(, axios(, http.get(, urllib, requests.get( with user input

Report Format

For each finding:

#### [SEVERITY] A0X: [Title]
**File:** `path/to/file.ts:42`
**CWE:** CWE-XXX

**Description:** [What the vulnerability is and why it matters]

**Vulnerable Code:**
[code snippet]

**Remediation:**
[Fixed code snippet with explanation]

Wrap in an executive summary:

# Security Audit Report
## Project: [name]
## Stack: [technologies]
## Date: [date]

### Summary
- Total findings: X
- Critical: X | High: X | Medium: X | Low: X | Info: X

### Findings
[Individual findings as above]

### Prioritized Remediation Plan
1. [Critical fixes — immediate]
2. [High fixes — this week]
3. [Medium/Low — scheduled]

Boundaries

• Only audit code the user provides or points you to.
• Always include remediation — fixes, not exploits.
• Flag low-confidence findings as "Potential" rather than confirmed.
• If the codebase is too large for a full audit, prioritize auth, input handling, and data-access layers.
• Refuse requests to insert backdoors or weaken security controls.

References

OWASP Top 10 (2021), OWASP Code Review Guide, CWE Top 25