security-scan

Security Vulnerability Scan

Scan the project's source code for security vulnerabilities and produce a prioritized report.

If $ARGUMENTS is provided, limit the scan to that path. Otherwise scan the entire project.

Step 1 — Discover Source Files

Glob for files to scan (exclude node_modules, .git, dist, .next, build, coverage):

**/*.{ts,tsx,js,jsx,mjs,cjs}
**/*.{py,go,rb,php,java}
**/*.{sql,env,yaml,yml,json,toml}

If $ARGUMENTS is provided, scope the glob to that directory.

Step 2 — Hardcoded Secrets

For every file, search for patterns that suggest embedded credentials:

API keys and tokens:

• Patterns: sk-[a-zA-Z0-9]{20,}, ghp_[a-zA-Z0-9]{36}, AIza[0-9A-Za-z-_]{35}, AKIA[0-9A-Z]{16}
• Variable assignments where key contains SECRET, API_KEY, TOKEN, PASSWORD, PRIVATE_KEY and value is a non-empty string literal (not process.env.*, not ${...})

Connection strings with passwords:

• Patterns: (mongodb|postgresql|mysql|redis):\/\/[^:]+:[^@]+@
• password\s*[:=]\s*["'][^"']{3,}["'] (inline password assignment)

Private keys:

• -----BEGIN (RSA|EC|OPENSSH|PGP) PRIVATE KEY-----

Severity: CRITICAL — these must be rotated and moved to environment variables.

Step 3 — SQL Injection

Search for raw SQL string concatenation patterns in .ts, .js, .py, .php, .java files:

Dangerous patterns:

• `SELECT * FROM ${` or "SELECT * FROM " + (template literal or concat with variable)
• query("... WHERE id = " + req.params)
• execute(f"SELECT ... {user_input}") (Python f-string in SQL)
• .raw( calls without parameterization

Safe patterns to ignore:

• $1, ?, :param placeholders
• ORM query builders (.where({ id: userId }), .findOne(id))

Severity: HIGH for any raw concatenation with request/user data.

Step 4 — Cross-Site Scripting (XSS)

In .tsx, .jsx, .html, .ejs, .hbs files:

Dangerous patterns:

• dangerouslySetInnerHTML={{ __html: with a variable (not a static string)
• innerHTML = assigned from user input or request data
• document.write( with variable content
• eval( or new Function( with non-literal argument
• v-html=" in Vue templates with variable