security-scan

Security Scan

Run a full security audit of the current repository combining dependency, code, and secret scanning.

What to do:

1. Identify repository: Determine the current repository (owner/repo) from Git configuration

   • Use git remote -v or check .git/config to find the repository
   • Parse owner and repo name from GitHub URL

2. Run comprehensive security checks (in parallel if possible):

   a) Dependency vulnerabilities: Use GitHub MCP's list_dependabot_alerts

   • Parameters: owner, repo, state: "open"
   • Collect: CVE IDs, severity, affected packages, fix versions

   b) Code security issues: Use GitHub MCP's list_code_scanning_alerts

   • Parameters: owner, repo, state: "open"
   • Collect: Rule IDs, severity, locations, descriptions

   c) Secret exposure: Use GitHub MCP's list_secret_scanning_alerts

   • Parameters: owner, repo, state: "open"
   • Collect: Secret types, locations (NEVER actual values)

3. Aggregate and analyze all findings:

   • Combine all alerts across all three scan types
   • Group by severity: Critical, High, Medium, Low
   • Sort by severity and impact
   • Calculate total vulnerability count

4. Present comprehensive security report:

   ═══════════════════════════════════════════════════════
   Security Audit Report for owner/repo
   ═══════════════════════════════════════════════════════
   
   📊 Executive Summary:
   Total security issues: X
   - Critical: X
   - High: X
   - Medium: X
   - Low: X
   
   ═══════════════════════════════════════════════════════
   🔴 Critical & High Priority Issues
   ═══════════════════════════════════════════════════════
   
   [Dependency Vulnerabilities]
   1. package-name@version - CVE-XXXX-XXXX (Critical)
      Type: [Vulnerability type, e.g., Remote Code Execution]
      Impact: [What could happen]
      Fix: npm install [email protected]
      Details: /explain-cve CVE-XXXX-XXXX
   
   2. another-package@version - CVE-YYYY-YYYY (High)
      Type: [Vulnerability type]
      Impact: [What could happen]
      Fix: yarn upgrade another-package@^X.X.X
   
   [Code Security Issues]
   3. [Rule name] detected (High)
      Location: src/file.js:42
      Issue: [Brief description]
      Recommendation: [How to fix]
   
   [Exposed Secrets]
   4. AWS Access Key exposed (Critical)
      Location: config/settings.yml
      ⚠️  IMMEDIATE ACTION REQUIRED: Revoke and rotate credential
   
   [Show top 5-10 most critical across all categories]
   
   ═══════════════════════════════════════════════════════
   📋 Breakdown by Category
   ═══════════════════════════════════════════════════════
   
   🔧 Dependencies: X issues
   💻 Code Security: X issues
   🔒 Exposed Secrets: X issues
   
   ═══════════════════════════════════════════════════════
   ✅ Recommended Actions (Prioritized)
   ═══════════════════════════════════════════════════════
   
   **Immediate (Critical):**
   1. Revoke exposed AWS key and rotate credentials
   2. Update package-name to fix CVE-XXXX-XXXX (RCE vulnerability)
   3. [Other critical items]
   
   **High Priority (This Week):**
   1. Fix [code security issue] in src/file.js
   2. Update [high-severity dependencies]
   3. [Other high priority items]
   
   **Medium Priority (This Sprint):**
   1. Address remaining dependency updates
   2. Review and fix code scanning alerts
   3. [Other medium priority items]
   
   **Low Priority (Backlog):**
   1. [Low severity items]
   
   ═══════════════════════════════════════════════════════
   🔗 Additional Resources
   ═══════════════════════════════════════════════════════
   
   - Full Dependabot alerts: https://github.com/owner/repo/security/dependabot
   - Code scanning alerts: https://github.com/owner/repo/security/code-scanning
   - Secret scanning alerts: https://github.com/owner/repo/security/secret-scanning
   
   💡 Next Steps:
   - Use /explain-cve [CVE-ID] for detailed vulnerability explanations
   - Use /check-deps for quick dependency-only checks
   - Use /check-secrets to focus on credential exposure
   - Review GitHub Security tab for complete details