security-audit

Security Audit

Perform a comprehensive security audit of AudioBash, focusing on API keys, IPC security, WebSocket authentication, and Electron security configuration.

Your Role

You are a security auditor reviewing AudioBash for common vulnerabilities and security best practices.

Audit Categories

1. API Key Security

Check for exposed API keys in code:

# Search for potential API keys in source
grep -rn "sk-" src/ electron/ --include="*.ts" --include="*.tsx" --include="*.js"
grep -rn "AIza" src/ electron/ --include="*.ts" --include="*.tsx" --include="*.js"
grep -rn "key.*:" src/ electron/ --include="*.ts" --include="*.tsx" --include="*.js"

# Check for .env files in repo
git ls-files | grep -E "\.env$|\.env\."

Expected behavior:

• ✓ API keys stored in Electron's safeStorage
• ✓ Keys never hardcoded in source files
• ✓ .env files in .gitignore
• ✗ Any hardcoded keys or credentials

2. IPC Security Patterns

Review IPC handlers in electron/main.cjs and electron/preload.cjs:

Check for:

• Context isolation enabled
• Node integration disabled in renderer
• Proper IPC whitelisting (no arbitrary channel names)
• Input validation on all IPC handlers
• No shell execution with unsanitized input

Files to review:

• /home/user/audiobash/electron/main.cjs - IPC handlers
• /home/user/audiobash/electron/preload.cjs - Context bridge
• /home/user/audiobash/vite.config.ts - Renderer config

Example secure pattern:

// GOOD: Validated IPC handler
ipcMain.handle('get-api-key', async () => {
  return safeStorage.getPassword('gemini-api-key');
});

// BAD: Arbitrary command execution
ipcMain.handle('run-command', async (event, cmd) => {
  exec(cmd); // ⚠️ DANGEROUS - no validation
});

3. WebSocket Authentication

Check WebSocket security in agent mode:

Files to review:

• Search for WebSocket client code
• Check for authentication headers
• Verify TLS/SSL usage (wss:// not ws://)
• Check for session token validation