security-scan

Security Scan

Security-focused code scanning. Run before commits and PRs to catch vulnerabilities.

Phase 1: Secret Detection

Scan for hardcoded credentials:

# Common secret patterns
grep -rn "password\s*[=:]\s*['\"]" --include=*.js --include=*.ts --include=*.py --include=*.go --include=*.java --include=*.rb . 2>/dev/null | grep -v node_modules | grep -v ".git"
grep -rn "api[_-]?key\s*[=:]\s*['\"]" --include=*.js --include=*.ts --include=*.py --include=*.go --include=*.java --include=*.rb . 2>/dev/null | grep -v node_modules
grep -rn "secret\s*[=:]\s*['\"]" --include=*.js --include=*.ts --include=*.py --include=*.go --include=*.java --include=*.rb . 2>/dev/null | grep -v node_modules
grep -rn "token\s*[=:]\s*['\"]" --include=*.js --include=*.ts --include=*.py --include=*.go --include=*.java --include=*.rb . 2>/dev/null | grep -v node_modules

# AWS keys
grep -rn "AKIA[0-9A-Z]{16}" . 2>/dev/null | grep -v node_modules

# Private keys
find . -name "*.pem" -o -name "*.key" -o -name "id_rsa" 2>/dev/null | grep -v node_modules

Phase 2: Dependency Audit

Check for vulnerable dependencies:

Node.js

npm audit --json 2>/dev/null | head -100
# or
yarn audit --json 2>/dev/null | head -100

Python

pip-audit 2>/dev/null || safety check 2>/dev/null

Go

govulncheck ./... 2>/dev/null

Rust

cargo audit 2>/dev/null

Phase 3: Code Pattern Analysis

Check for dangerous patterns:

SQL Injection

• String concatenation in SQL queries
• Unparameterized queries
• Dynamic table/column names from user input

Command Injection

• Shell execution with user input (exec, system, subprocess)
• Unsanitized path construction

XSS Vulnerabilities

• innerHTML with user data
• dangerouslySetInnerHTML without sanitization
• Unescaped template variables

Path Traversal

• User input in file paths without sanitization
• Missing .. checks

Phase 4: Configuration Check

Verify security settings: