security-audit-checklist

Security Audit Checklist

Comprehensive security vulnerability checklists organized by severity with quantified point deductions for code review scoring.

Quick Start

Full security audit:

Run a complete security audit using the OWASP Top 10 checklist with severity scoring.

Language-specific scan:

Check this Node.js codebase for injection vulnerabilities and authentication issues.

Severity Classification

Severity	Multiplier	Point Range	Response Time
Critical	2.0x	2.0-4.0	Immediate (block deploy)
High	1.5x	1.0-2.0	24 hours
Medium	1.0x	0.5-1.0	1 week
Low	0.5x	0.25-0.5	Next sprint

Critical Vulnerabilities (P0)

SQL Injection

Base Deduction: 2.0 points | Severity: Critical (2.0x) | Total: 4.0 points

Detection Commands:

# String interpolation in queries
grep -rn "\`SELECT.*\${" src/
grep -rn "\"SELECT.*\" \+" src/
grep -rn "query.*\`.*\${" src/
grep -rn "execute.*f\"" src/  # Python f-strings

# Raw queries without parameterization
grep -rn "\.raw\(" src/
grep -rn "\.rawQuery\(" src/
grep -rn "createQuery.*\+" src/  # Java JPA

Evidence Template:

Location: {file}:{line}
Pattern: Unparameterized SQL with user input
Measurement: {count} injection vectors
Impact: Full database compromise, data exfiltration

Remote Code Execution (RCE)

Base Deduction: 2.0 points | Severity: Critical (2.0x) | Total: 4.0 points

Detection Commands:

# Command injection
grep -rn "exec\(" src/
grep -rn "eval\(" src/
grep -rn "spawn.*shell.*true" src/
grep -rn "subprocess.*shell=True" src/
grep -rn "os\.system\(" src/

# Unsafe deserialization
grep -rn "pickle\.loads\(" src/
grep -rn "yaml\.load\(" src/ | grep -v "safe_load"
grep -rn "ObjectInputStream" src/
grep -rn "unserialize\(" src/

Evidence Template:

Location: {file}:{line}
Pattern: {exec|eval|deserialization} with user-controlled input
Measurement: {count} RCE vectors
Impact: Complete server compromise, lateral movement

Hardcoded Secrets

Base Deduction: 2.0 points | Severity: Critical (2.0x) | Total: 4.0 points

Detection Commands:

# API keys and tokens
grep -rn "AKIA[0-9A-Z]{16}" src/
grep -rn "sk_live_" src/
grep -rn "gh[pousr]_[A-Za-z0-9_]" src/
grep -rn "xox[baprs]-" src/

# Generic patterns
grep -rn "password\s*=\s*['\"]" src/
grep -rn "api_key\s*=\s*['\"]" src/
grep -rn "secret\s*=\s*['\"]" src/
grep -rn "token\s*=\s*['\"][^'\"]*['\"]" src/

# Private keys
grep -rn "BEGIN.*PRIVATE KEY" src/
grep -rn "BEGIN RSA PRIVATE" src/

Evidence Template:

Location: {file}:{line}
Pattern: {AWS key|Stripe key|generic secret} hardcoded
Measurement: {count} secrets exposed
Impact: Credential theft, financial fraud, account takeover

Authentication Bypass

Base Deduction: 2.0 points | Severity: Critical (2.0x) | Total: 4.0 points

Detection Commands:

# Missing auth middleware
grep -rn "app\.\(get\|post\|put\|delete\)" src/ | grep -v "auth\|protect\|require"

# JWT issues
grep -rn "algorithm.*none" src/
grep -rn "verify.*false" src/
grep -rn "ignoreExpiration.*true" src/

# Session issues
grep -rn "session\.secret.*=.*['\"]" src/
grep -rn "secure.*false" src/ | grep -i cookie

Evidence Template:

Location: {file}:{line}
Pattern: {missing auth check|weak JWT|insecure session}
Measurement: {count} unprotected endpoints
Impact: Unauthorized access, privilege escalation

High Vulnerabilities (P1)

Cross-Site Scripting (XSS)

Base Deduction: 1.5 points | Severity: High (1.5x) | Total: 2.25 points

Detection Commands:

# React dangerouslySetInnerHTML
grep -rn "dangerouslySetInnerHTML" src/

# Template injection
grep -rn "<%- " src/  # EJS unescaped
grep -rn "\|safe" src/  # Django/Jinja unescaped
grep -rn "v-html" src/  # Vue
grep -rn "{!! " src/  # Laravel Blade

# DOM manipulation
grep -rn "\.innerHTML\s*=" src/
grep -rn "document\.write\(" src/

Evidence Template:

Location: {file}:{line}
Pattern: {dangerouslySetInnerHTML|innerHTML|unescaped template}
Measurement: {count} XSS vectors
Impact: Session hijacking, credential theft, defacement

Insecure Direct Object Reference (IDOR)

Base Deduction: 1.5 points | Severity: High (1.5x) | Total: 2.25 points

Detection Commands:

# Direct ID usage without ownership check
grep -rn "params\.id\|req\.params\.id" src/
grep -rn "findById.*req\.params" src/
grep -rn "findOne.*id.*=.*req" src/

# Check if ownership validation exists nearby

Audit Questions:

Does every resource access check ownership?
Are UUIDs used instead of sequential IDs?
Is there row-level security in the database?

Server-Side Request Forgery (SSRF)

Base Deduction: 1.5 points | Severity: High (1.5x) | Total: 2.25 points

Detection Commands:

# URL from user input
grep -rn "fetch\(.*req\." src/
grep -rn "axios\.\(get\|post\).*req\." src/
grep -rn "requests\.get\(.*request\." src/
grep -rn "http\.get\(.*params" src/

# Redirects
grep -rn "redirect\(.*req\." src/

Evidence Template:

Location: {file}:{line}
Pattern: HTTP request with user-controlled URL
Measurement: {count} SSRF vectors
Impact: Internal network scanning, cloud metadata access

Missing Rate Limiting

Base Deduction: 1.0 points | Severity: High (1.5x) | Total: 1.5 points

Detection Commands:

# Check for rate limiter middleware
grep -rn "rateLimit\|rate-limit\|RateLimiter" src/

# Sensitive endpoints without rate limiting
grep -rn "login\|register\|password\|forgot\|reset" src/routes/

Audit Questions:

Are login endpoints rate-limited?
Is password reset rate-limited?
Are API endpoints throttled per user?

Medium Vulnerabilities (P2)

Missing Input Validation

Base Deduction: 0.75 points | Severity: Medium (1.0x) | Total: 0.75 points

Detection Commands:

# Direct body/query usage without validation
grep -rn "req\.body\." src/ | head -20
grep -rn "req\.query\." src/ | head -20
grep -rn "request\.json\(\)" src/

# Check for validation libraries
grep -rn "zod\|yup\|joi\|validator\|pydantic" package.json src/

Weak Cryptography

Base Deduction: 0.75 points | Severity: Medium (1.0x) | Total: 0.75 points

Detection Commands:

# Weak hash algorithms
grep -rn "md5\|MD5" src/
grep -rn "sha1\|SHA1" src/ | grep -v "sha1.*integrity"

# Weak encryption
grep -rn "DES\|3DES\|RC4\|ECB" src/

# Insecure random
grep -rn "Math\.random\(\)" src/
grep -rn "random\.random\(\)" src/

Missing Security Headers

Base Deduction: 0.5 points | Severity: Medium (1.0x) | Total: 0.5 points

Required Headers Checklist:

Content-Security-Policy
X-Content-Type-Options: nosniff
X-Frame-Options: DENY
Strict-Transport-Security
Referrer-Policy
Permissions-Policy

Detection Commands:

# Check for helmet or manual headers
grep -rn "helmet\|setHeader.*Content-Security" src/
grep -rn "X-Frame-Options\|X-Content-Type" src/

CORS Misconfiguration

Base Deduction: 0.5 points | Severity: Medium (1.0x) | Total: 0.5 points

Detection Commands:

# Dangerous CORS patterns
grep -rn "origin.*\*\|origin.*true" src/
grep -rn "Access-Control-Allow-Origin.*\*" src/
grep -rn "credentials.*true" src/ | grep -i cors

# Check for origin reflection
grep -rn "origin.*req\.headers\.origin" src/

Low Vulnerabilities (P3)

Verbose Error Messages

Base Deduction: 0.25 points | Severity: Low (0.5x) | Total: 0.125 points

Detection Commands:

# Stack traces exposed
grep -rn "error\.stack\|err\.stack" src/
grep -rn "res\.send.*error\|res\.json.*error" src/

# Debug mode in production
grep -rn "DEBUG.*true\|debug.*=.*true" src/

Missing Audit Logging

Base Deduction: 0.25 points | Severity: Low (0.5x) | Total: 0.125 points

Audit Questions:

Are authentication events logged?
Are authorization failures logged?
Are sensitive data access events logged?
Do logs include user ID, action, timestamp, IP?

Outdated Dependencies

Base Deduction: 0.25-1.0 points | Severity: Varies

Detection Commands:

# NPM security audit
npm audit --json 2>/dev/null | jq '.metadata.vulnerabilities'

# Check for outdated
npm outdated 2>/dev/null

# Python
pip-audit 2>/dev/null
safety check 2>/dev/null

Scoring:

CVE Severity	Deduction
Critical	1.0 per CVE
High	0.5 per CVE
Medium	0.25 per CVE
Low	0.1 per CVE

Language-Specific Checklists

Node.js/JavaScript

See references/nodejs-security.md for:

Prototype pollution patterns
Event emitter leaks
Path traversal in file serving
Child process injection
Regular expression DoS (ReDoS)

Python

See references/python-security.md for:

Pickle/YAML deserialization
Template injection (Jinja2, Django)
OS command injection
Path traversal

Go

See references/go-security.md for:

SQL injection with database/sql
Path traversal in http.FileServer
Race conditions
Unsafe pointer usage

Java

See references/java-security.md for:

XXE in XML parsers
Deserialization gadget chains
JNDI injection
Expression Language injection

Audit Report Template

## Security Audit Summary

| Severity | Count | Total Deduction |
|----------|-------|-----------------|
| Critical | {n} | {n * 4.0} |
| High | {n} | {n * 2.25} |
| Medium | {n} | {n * 0.75} |
| Low | {n} | {n * 0.125} |
| **Total** | **{sum}** | **{sum} points** |

### Critical Findings (P0)

#### Finding 1: {Title}
| Field | Value |
|-------|-------|
| Location | `{file}:{line}` |
| Vulnerability | {type} |
| OWASP | A0{n}:{name} |
| CVSS | {score} |
| Deduction | {points} |

**Evidence:**
```{lang}
{code snippet}

Remediation: {specific fix with code example}

{Repeat for all findings}


## Integration with Brutal Reviewer

This skill provides the Security category scoring for the brutal-reviewer agent:

- **Weight:** 12% of total score
- **Maximum Deduction:** 9.0 points (capped)
- **Grade Thresholds:**
  - A: 0 critical, 0 high
  - B: 0 critical, 1-2 high
  - C: 0 critical, 3+ high OR 1 critical (fixed quickly)
  - D: 1-2 critical
  - F: 3+ critical OR any actively exploitable

About this skill

Quick Start

Severity Classification

Critical Vulnerabilities (P0)

SQL Injection

Remote Code Execution (RCE)

Hardcoded Secrets

Authentication Bypass

High Vulnerabilities (P1)

Cross-Site Scripting (XSS)

Insecure Direct Object Reference (IDOR)

Server-Side Request Forgery (SSRF)

Missing Rate Limiting

Medium Vulnerabilities (P2)

Missing Input Validation

Weak Cryptography

Missing Security Headers

CORS Misconfiguration

Low Vulnerabilities (P3)

Verbose Error Messages

Missing Audit Logging

Outdated Dependencies

Language-Specific Checklists

Node.js/JavaScript

Python

Go

Java

Audit Report Template