security-audit

Security Audit

Scan code for security vulnerabilities and secrets. Detects exposed API keys, passwords, insecure patterns, and common vulnerabilities.

Setup

No additional setup required.

Usage

Scan for Secrets

{baseDir}/security-audit.js --scan --path /path/to/code

Check for Vulnerabilities

{baseDir}/security-audit.js --vulns --path /path/to/code

Full Audit

{baseDir}/security-audit.js --full --path /path/to/code

Options

Option	Description	Required
--scan	Scan for secrets	No
--vulns	Check for vulnerabilities	No
--full	Full security audit	No
--path	Path to scan	Yes
--output	Output format (json, text)	No

Detected Patterns

Secrets

• AWS keys: AKIA...
• GitHub tokens: ghp_..., gho_...
• Generic API keys
• Private keys (RSA, DSA, EC)
• Database connection strings
• JWT tokens

Vulnerabilities

• SQL injection patterns
• Command injection patterns
• Path traversal
• Hardcoded passwords
• Weak cryptographic algorithms
• Insecure random

Output Format

{
  "secrets": [
    {
      "file": "config.js",
      "line": 10,
      "type": "api_key",
      "context": "apiKey = '..."
    }
  ],
  "vulnerabilities": [
    {
      "file": "app.js",
      "line": 25,
      "type": "sql_injection",
      "message": "Potential SQL injection"
    }
  ]
}

When to Use

• Pre-commit security checks
• CI/CD security scanning
• Code review assistance
• Detecting accidental secret exposure