🔐 Security Audit and Vulnerability Scanning
Version: 2.0.0
Last Updated: 2025-11-22
Priority: ⭐⭐⭐⭐ (P1 Level)
Purpose: Comprehensive security audit and vulnerability scanning
📋 Overview
Provides a comprehensive security audit workflow including dependency vulnerability scanning, unsafe code detection, and secret management.
🎯 P0: Invocation Triggers
| Trigger |
Example |
| Vulnerability scan |
"scan for security vulnerabilities" |
| CVE check |
"are there any CVEs?" |
| Code audit |
"audit the codebase" |
| Before deployment |
"before production deployment" |
| Regular audit |
"weekly security check" |
🔧 P1: Security Tools List
Tool Priority
| Tool |
Purpose |
Frequency |
Command |
cargo-audit |
Dependency CVE |
High |
cargo audit |
cargo-deny |
Policy enforcement |
High |
cargo deny check |
cargo-geiger |
unsafe detection |
Medium |
cargo geiger |
gitleaks |
Secret detection |
High |
gitleaks detect |
cargo-supply-chain |
Supply chain |
Low |
cargo supply-chain |
🚀 P2: Audit Patterns
Pattern 1: Full security audit
# Step 1: 依存関係脆弱性
cargo audit
# Step 2: ポリシーチェック
cargo deny check
# Step 3: unsafe使用量
cargo geiger --output-format Json
# Step 4: シークレット検出
gitleaks detect --source . --verbose
# Step 5: サプライチェーン
cargo supply-chain crates
Pattern 2: Quick audit (for CI)
# 最小限のチェック（2-3分）
cargo audit && cargo deny check advisories
Pattern 3: Clippy security lints
# セキュリティ関連警告
cargo clippy -- \
-D warnings \
-W clippy::all \
-W clippy::pedantic \
-A clippy::missing_errors_doc
⚡ P3: Vulnerability Response
Response by Severity
| Severity |
Response deadline |
Action |
| Critical |
Immediate |
Stop deployment, fix immediately |
| High |
24 hours |
Priority fix, consider workaround |
| Medium |
1 week |
Planned fix |
| Low |
1 month |
At next update |
Dependency Updates
# 特定クレート更新
cargo update -p vulnerable-crate
# Cargo.toml バージョン指定
[dependencies]
vulnerable-crate = ">=1.2.3" # 修正版以降
📊 deny.toml Configuration Example
[advisories]
db-path = "~/.cargo/advisory-db"
vulnerability = "deny"
unmaintained = "warn"
[licenses]
allow = ["MIT", "Apache-2.0", "BSD-3-Clause"]
copyleft = "deny"
[bans]
multiple-versions = "warn"
wildcards = "deny"
[sources]
allow-git = []
🛡️ Secret Management
Detection Patterns
| Pattern |
Example |
Action |
| AWS Key |
AKIA... |
Revoke immediately |
| GitHub Token |
ghp_... |
Revoke immediately |
| API Key |
sk-... |
Revoke immediately |
| Private Key |
-----BEGIN |
Purge from repository |
Handling Accidental Commits
# ファイル削除
git rm --cached secrets.json
git commit --amend --no-edit
# 履歴からパージ（重大な場合）
git filter-repo --invert-paths --path secrets.json
✅ Success Criteria
| Check item |
Criteria |
cargo audit |
0 vulnerabilities |
cargo deny |
0 denied |
cargo geiger |
unsafe minimization |
gitleaks |
0 secrets |
Output Format
🔐 Security Audit Results
✅ Dependencies: 0 vulnerabilities
✅ Policy: All checks passed
⚠️ Unsafe: 5 blocks (3rd party only)
✅ Secrets: No leaks detected
Ready for production ✓
🔗 Related Skills
- Rust Development: Build quality
- Dependency Management: Dependency updates
- Debugging: Security issue investigation
