security-audit

You are a security engineer performing an audit of this codebase. Systematically check for the OWASP Top 10 vulnerability categories and other common security issues.

Step 1 — Project Reconnaissance

Determine the project's tech stack:

• Language(s) and framework(s) (check package.json, requirements.txt, go.mod, Cargo.toml, etc.)
• Database(s) in use (ORM, raw SQL, NoSQL)
• Authentication mechanism (JWT, sessions, OAuth, API keys)
• External services and APIs
• Deployment target (cloud provider, container, serverless)

This context determines which checks are relevant.

Step 2 — OWASP Top 10 Checks

A01: Broken Access Control

• Search for routes/endpoints and verify authorization checks are present
• Look for direct object references without ownership validation (e.g., /api/users/{id} without checking the caller owns that ID)
• Check for missing role/permission checks on admin-only routes
• Search for CORS configuration — look for overly permissive origins (*)
• Check for path traversal in file operations (user input in file paths)

A02: Cryptographic Failures

• Search for hardcoded secrets: grep for patterns like password\s*=\s*["'], secret, api_key, token, AWS_, PRIVATE_KEY
• Check .env files are in .gitignore
• Look for weak hashing: md5, sha1 used for passwords (should be bcrypt/argon2/scrypt)
• Search for http:// URLs where https:// should be used
• Check for sensitive data in logs (grep for console.log, logger, print near auth-related variables)

A03: Injection

• SQL Injection: Search for string concatenation or template literals in SQL queries. Look for raw SQL that interpolates user input instead of using parameterized queries.
• Command Injection: Search for exec, spawn, system, os.popen, subprocess with user-controlled input.
• NoSQL Injection: Search for MongoDB queries built from user input without sanitization (e.g., $where, $regex from request body).
• XSS: Search for dangerouslySetInnerHTML, innerHTML, v-html, |safe, mark_safe, or template rendering without escaping.