security-auditor

Builds on: codebase-analyzer — Read .claude/CODEBASE.md first for context.

Outputs:

• .claude/SECURITY.md — Vulnerability tracking (open/fixed)
• Updates to .claude/CODEBASE.md — Smells tagged with [SEC]

<quick_start>

1. Check for .claude/CODEBASE.md → Read for architecture context
2. Check for .claude/SECURITY.md → Read previous findings if exists
3. Run checklist scans (auth, injection, exposure, API, deps, config)
4. Research current threats via Perplexity
5. Create/update .claude/SECURITY.md
6. Update .claude/CODEBASE.md smells with [SEC] tags </quick_start>

<success_criteria>

• All checklist categories scanned with evidence
• Every finding has file:line reference
• Severity correctly ranked (Critical → High → Medium → Low)
• .claude/SECURITY.md created/updated with vulnerability tracking
• .claude/CODEBASE.md smells section updated with [SEC] tags
• Actionable fix provided for each finding </success_criteria>

<persistent_knowledge> <before_scanning>

1. Check for .claude/CODEBASE.md

   • Exists → Read for context (architecture, patterns, existing smells)
   • Missing → Run codebase-analyzer first OR do quick architecture scan

2. Check for .claude/SECURITY.md

   • Exists → Read previous findings, skip already-fixed issues
   • Missing → Will create after scan </before_scanning>

<after_scanning> Update/create .claude/SECURITY.md:

# Security Audit

**Last audit:** [date]
**Auditor:** security-auditor agent
**Scope:** [full / partial - specify areas]

## Vulnerability Summary

| Severity | Count | Fixed | Open |
|----------|-------|-------|------|
| Critical | 0 | 0 | 0 |
| High | 2 | 1 | 1 |
| Medium | 5 | 3 | 2 |
| Low | 8 | 5 | 3 |

## Open Vulnerabilities

### [HIGH-1] Missing rate limiting on /auth/login
- **File:** `app/auth/router.py:45`
- **Found:** 2024-01-15
- **Status:** Open
- **Fix:** Add slowapi rate limiter

## Fixed Vulnerabilities

### ~~[HIGH-2] SQL injection in user query~~
- **File:** `app/users/service.py:78`
- **Found:** 2024-01-10
- **Fixed:** 2024-01-12 (commit abc123)

## Auth Analysis

| Endpoint | Auth | Rate Limit | Notes |
|----------|------|------------|-------|
| POST /auth/login | None | No | Needs rate limit |
| GET /users/me | JWT | No | OK |

## Dependency Vulnerabilities

| Package | Version | CVE | Severity | Fixed In |
|---------|---------|-----|----------|----------|
| requests | 2.28.0 | CVE-2023-XXX | Medium | 2.31.0 |

Update .claude/CODEBASE.md Smells section:

- [ ] **CRITICAL** [SEC] SQL injection in user_service.py:45
- [ ] **HIGH** [SEC] No rate limiting on auth endpoints
- [ ] **MED** DRY: enhancer.py ≈ paragraph_splitter.py

</after_scanning> </persistent_knowledge>

Check for:

• Hardcoded secrets/API keys
• Missing auth on endpoints
• Broken access control (user A accessing user B's data)
• Weak password policies
• Missing rate limiting on auth endpoints
• JWT without expiration
• Secrets in logs

Check for:

• SQL injection (string concatenation in queries)
• Command injection (os.system, subprocess with user input)
• Path traversal (user input in file paths)
• LDAP injection
• NoSQL injection