79573df7cb
20 specialized agents, 10 skills, 17 slash commands, 6 plugins, 12 hooks with scripts, 8 rule sets, 3 CLAUDE.md templates, 14 MCP server configs, and interactive setup installer.
50 lines
2.4 KiB
Markdown
50 lines
2.4 KiB
Markdown
Perform a security audit of the codebase covering common vulnerability categories.
|
|
|
|
## Steps
|
|
|
|
### 1. Dependency Vulnerabilities
|
|
- Run the package manager's audit: `npm audit`, `pip audit`, `cargo audit`, `govulncheck ./...`.
|
|
- List critical and high severity vulnerabilities.
|
|
- For each, determine if the vulnerable code path is actually reachable in this project.
|
|
- Recommend specific version upgrades or patches.
|
|
|
|
### 2. Secrets Scan
|
|
- Search for hardcoded secrets, API keys, tokens, and passwords:
|
|
- Patterns: `password\s*=`, `api[_-]?key`, `secret`, `token`, `Bearer `, base64-encoded strings.
|
|
- Files: `.env` files committed to git, config files, source code.
|
|
- Check `.gitignore` for proper exclusion of sensitive files.
|
|
- Verify environment variables are used for all secrets.
|
|
|
|
### 3. OWASP Top 10 Check
|
|
- **Injection**: SQL injection, command injection, XSS. Search for string concatenation in queries, `eval()`, `innerHTML`.
|
|
- **Broken Auth**: Weak password policies, missing rate limiting, session fixation.
|
|
- **Sensitive Data Exposure**: Unencrypted data at rest/transit, verbose error messages, logs containing PII.
|
|
- **Broken Access Control**: Missing authorization checks, IDOR vulnerabilities, privilege escalation paths.
|
|
- **Security Misconfiguration**: Default credentials, unnecessary features enabled, CORS wildcards.
|
|
|
|
### 4. Input Validation
|
|
- Verify all user inputs are validated before processing.
|
|
- Check for proper type coercion and boundary checking.
|
|
- Ensure file uploads have type, size, and name validation.
|
|
- Verify URL and redirect validation prevents open redirects.
|
|
|
|
### 5. Authentication and Authorization Review
|
|
- Check password hashing (bcrypt/argon2, not MD5/SHA1).
|
|
- Verify JWT token expiration and rotation.
|
|
- Check for proper CSRF protection.
|
|
- Verify role-based access control at the API layer, not just the UI.
|
|
|
|
### 6. Report
|
|
Produce a findings report organized by severity (Critical, High, Medium, Low, Info) with:
|
|
- Finding description.
|
|
- Affected file and line.
|
|
- Recommended fix.
|
|
- Reference (CWE number or OWASP category).
|
|
|
|
## Rules
|
|
|
|
- Prioritize findings by exploitability and impact, not just theoretical risk.
|
|
- Include proof-of-concept for critical findings when safe to do so.
|
|
- Do not just list tools to run. Actually analyze the output and provide actionable recommendations.
|
|
- Check both the application code and infrastructure configuration (Dockerfiles, CI configs, cloud configs).
|