workflow-review-security

You are in SECURITY REVIEW MODE.

Use security agent to perform thorough security audit.

Security Audit Process

1. OWASP Top 10 Review (30 mins)

A01: Broken Access Control

// ❌ CRITICAL: No authorization check
export async function deletePost(id: string) {
  await db.post.delete({ where: { id } })
}

// ✅ SECURE: Proper authorization
export async function deletePost(id: string) {
  const session = await auth()
  if (!session?.user) {
    throw new UnauthorizedError()
  }

  const post = await db.post.findUnique({
    where: { id },
    select: { authorId: true }
  })

  if (!post) {
    throw new NotFoundError()
  }

  if (post.authorId !== session.user.id && session.user.role !== 'ADMIN') {
    throw new ForbiddenError()
  }

  await db.post.delete({ where: { id } })
}

Checklist:

• All protected routes check authentication
• Resource ownership verified before operations
• Role-based access control (RBAC) implemented
• No client-side authorization only
• API endpoints protected with middleware

A02: Cryptographic Failures

// ❌ CRITICAL: Storing plain text passwords
await db.user.create({
  data: { email, password } // Plain text!
})

// ✅ SECURE: Hashed passwords
import bcrypt from 'bcrypt'

const hashedPassword = await bcrypt.hash(password, 12)
await db.user.create({
  data: { email, password: hashedPassword }
})

Checklist:

• Passwords hashed with bcrypt (12+ rounds)
• HTTPS enforced in production
• Sensitive data encrypted at rest
• Secure session storage
• Environment variables for secrets
• No secrets in code or version control

A03: Injection

// ❌ CRITICAL: SQL injection risk (raw SQL)
const userId = req.query.id // User controlled!
await db.$executeRaw`SELECT * FROM users WHERE id = ${userId}`

// ✅ SECURE: Parameterized query
const userId = req.query.id
await db.user.findUnique({ where: { id: userId } })

// ✅ SECURE: Input validation
const validated = z.string().cuid().parse(userId)
await db.user.findUnique({ where: { id: validated } })