SuperAPI AI Directory
Partner with us中文AI newsFavorites
Skillssecurity-audit

security-audit

Security & auditing

View repository

Updated 10-16 01:35

About this skill

Security Audit

Systematic security review of a project covering dependency vulnerabilities, credential exposure, common code vulnerabilities, and configuration hardening.

When to Use

  • Before a release or deployment
  • After adding new dependencies
  • When onboarding to a new codebase
  • Periodic security reviews
  • After receiving a vulnerability report

Audit Checklist

1. Credential and Secret Scanning

Check for exposed secrets in the codebase:

# Check for common secret patterns in tracked files
git grep -n -i -E '(api_key|apikey|secret|password|token|credential|private_key)\s*[:=]' -- ':!*.md' ':!*.lock'

# Check for .env files tracked in git
git ls-files | grep -i '\.env'

# Check .gitignore covers sensitive files
for f in .env .env.local credentials.json secrets.yaml; do
  git check-ignore "$f" 2>/dev/null || echo "WARNING: $f not in .gitignore"
done

Files that must never be committed:

  • .env, .env.* (environment variables)
  • credentials.json, service-account.json (cloud credentials)
  • *.pem, *.key (private keys)
  • *.p12, *.pfx (certificates with private keys)

2. Dependency Vulnerability Scan

Python:

uv run pip-audit

JavaScript/TypeScript:

bun pm audit
# or check with npm for broader database
npm audit --omit=dev

Go:

govulncheck ./...

Review results against the severity rubric (shared with the dependency-auditor agent):

  • Critical: exploitable now or actively exploited (leaked live credential, known-exploited CVE in a reachable path). Must fix before release; blocks release-prep.
  • High: known vulnerability with a plausible attack path. Fix before the next release.
  • Medium: vulnerability with mitigating factors, or a major-version lag on a security-relevant package. Fix within the sprint.
  • Low: outdated without known vulnerabilities; license concerns to review. Track in backlog.

3. Code Vulnerability Patterns

Scan for common vulnerability patterns:

SQL Injection:

# Look for string interpolation in SQL
grep -rn 'f".*SELECT\|f".*INSERT\|f".*UPDATE\|f".*DELETE' --include='*.py'
grep -rn "format.*SELECT\|format.*INSERT" --include='*.py'

Command Injection:

# Look for shell=True or unsanitized subprocess calls
grep -rn 'shell=True\|os\.system\|subprocess\.call.*shell' --include='*.py'
grep -rn 'exec(\|eval(' --include='*.py' --include='*.js' --include='*.ts'

XSS (Cross-Site Scripting):

# Look for dangerouslySetInnerHTML or unescaped output
grep -rn 'dangerouslySetInnerHTML\|innerHTML\s*=' --include='*.tsx' --include='*.jsx' --include='*.ts' --include='*.js'

Path Traversal:

grep -rn 'open(.*\+\|os\.path\.join.*input\|req\.\(params\|query\|body\)' --include='*.py' --include='*.js'

4. Authentication and Authorization

Review:

  • Authentication endpoints use constant-time comparison for secrets
  • Session tokens have appropriate expiration
  • CORS configuration is restrictive (not * in production)
  • Rate limiting on auth endpoints
  • Password hashing uses bcrypt/argon2 (not MD5/SHA1)

5. Configuration Hardening

  • Debug mode disabled in production configs
  • HTTPS enforced (HSTS headers)
  • Security headers present (CSP, X-Frame-Options, X-Content-Type-Options)
  • Error messages do not leak stack traces in production
  • Logging does not include sensitive data (passwords, tokens)

6. Docker Security (if applicable)

  • Non-root user in Dockerfile
  • Base image is pinned to specific version (not latest)
  • No secrets in Docker build args or layers
  • Health checks configured
  • Read-only filesystem where possible

7. CI/CD Security

  • Secrets stored in GitHub Secrets (not in workflow files)
  • Third-party actions pinned to SHA (not tags)
  • Minimal permissions in workflow permissions: block
  • No pull_request_target with actions/checkout of PR head

Output Format

Present findings as a prioritized list:

## Security Audit Results

### Critical (must fix)
1. [CRED] API key found in src/config.py:42 - move to environment variable
2. [DEP] lodash 4.17.20 has prototype pollution (CVE-2021-23337)

### High (fix before release)
3. [CODE] SQL injection risk in src/db.py:88 - use parameterized queries

### Medium (fix within sprint)
4. [CONFIG] CORS allows * origin in production config

### Low (backlog)
5. [STYLE] Error responses include stack traces in non-debug mode

### Passed
- [x] No .env files in git
- [x] Docker runs as non-root
- [x] Dependencies up to date

Additional Resources