security_audit

Security Audit (OWASP Standards)

Use this skill to perform a "Paranoid Mode" security sweep.

Inputs

• Scope: The directory to audit.
• Depth: Full scan or quick check.

Tooling Strategy

• Use grep_search to find secrets ("API_KEY", "password") and vulnerable patterns (innerHTML, eval).
• Use view_file to check auth logic.

Workflow

1. Secrets Detection (Credentials)

• Scan: Look for API keys, passwords, tokens, or private keys.
• Fix: Move to .env. Add .env to .gitignore.

2. Injection Prevention (OWASP #1)

• SQL Injection: Are queries parameterized? ($1 vs string concat).
• XSS (Cross-Site Scripting):
  • JS: Check innerHTML or dangerouslySetInnerHTML.
  • User Input: Is it sanitized/escaped before rendering?

3. Authentication & Authorization (Broken Access Control)

• Endpoints: Do sensitive routes (e.g., /admin, /delete) have middleware checks?
• IDOR: can User A access User B's data by changing an ID in the URL?

4. Dependency Analysis (Supply Chain)

• Verify: Check package.json or requirements.txt for known vulnerable versions.
• Unused: Remove unused packages to reduce attack surface.

5. Report Generation (SECURITY.md)

Create/Update the report in the root:

• Audit Log: Date of scan.
• Findings:
  • 🔴 Critical: Secrets, Injection holes.
  • 🟡 Warning: Outdated deps, missing CSRF tokens.
  • 🟢 Passed: "Auth implemented on /admin".

6. Verification

• Confirm the fix is applied (e.g., secret is gone from code).
• Confirm SECURITY.md is updated.

API Security Best Practices

When auditing APIs specifically, verify the following patterns:

• Authentication: JWT validation is proper (signature checked, expiry checked).
• Rate Limiting: Public endpoints have rate limiting to prevent abuse and DDoS.
• Data Protection:
  • Ensure HTTPS is enforced.
  • Check that error messages are sanitized (no stack traces or DB schema info leaked to the client).
• Validation: Schema validation on all request bodies, query params, and headers.