security-scan

/code-guardian:security-scan

Perform a security-focused scan of the codebase targeting OWASP Top 10 and common vulnerability patterns.

Process

1. Determine the scan scope:

   • Default: scan the entire project from the repository root
   • If an argument is provided, limit scanning to that path
   • Identify the primary language(s) and framework(s) by checking package.json, requirements.txt, go.mod, Cargo.toml, etc.

2. Scan for each vulnerability category:

A01: Broken Access Control

• Search for endpoints missing authentication middleware
• Check for direct object reference patterns where user IDs from request params access resources without ownership verification
• Look for missing CORS configuration or overly permissive origins (*)
• Find routes that expose admin functionality without role checks

A02: Cryptographic Failures

• Grep for weak hashing algorithms: MD5, SHA1 used for passwords or tokens
• Check for hardcoded encryption keys, salts, or initialization vectors
• Look for HTTP URLs where HTTPS should be used (API calls, webhooks)
• Verify that sensitive data in logs is masked or redacted

A03: Injection

• Search for string concatenation or template literals in SQL queries
• Check for unsanitized input in shell exec, spawn, or system calls
• Look for innerHTML assignments, dangerouslySetInnerHTML without sanitization
• Find regex patterns vulnerable to ReDoS (catastrophic backtracking)

A04: Insecure Design

• Check for missing rate limiting on authentication endpoints
• Look for predictable resource IDs (sequential integers for sensitive resources)
• Verify that file uploads validate type, size, and content
• Check for missing CSRF protection on state-changing requests

A05: Security Misconfiguration

• Search for debug mode enabled in production configs
• Check for default credentials in config files or environment examples
• Look for overly verbose error messages that leak stack traces
• Verify security headers (CSP, X-Frame-Options, HSTS) in server config