security-audit

Security Audit

Full security scan of the workspace. Checks for credential leaks, file permissions, gitignore coverage, and hardcoded secrets.

Trigger

User invokes /security-audit or says "security check", "scan for secrets", "audit security"

Steps

1. Run secret scanner

if [ -f "{{PROJECT_ROOT}}/scripts/secret-scan.sh" ]; then
  bash "{{PROJECT_ROOT}}/scripts/secret-scan.sh"
else
  echo "SCANNER_MISSING"
fi

If the scanner script is missing, perform a manual scan:

# Search for common secret patterns in all non-binary files
grep -rn --include="*.md" --include="*.json" --include="*.env" --include="*.sh" --include="*.js" --include="*.ts" --include="*.yaml" --include="*.yml" \
  -E "(sk-[a-zA-Z0-9]{20,}|AKIA[A-Z0-9]{16}|ghp_[a-zA-Z0-9]{36}|xox[bpoas]-[a-zA-Z0-9-]+|-----BEGIN (RSA |EC )?PRIVATE KEY-----)" \
  "{{PROJECT_ROOT}}/" 2>/dev/null || echo "NO_SECRETS_FOUND"

2. Check file permissions

echo "=== Secrets Directory ==="
if [ -d "{{SECRETS_DIR}}" ]; then
  stat -f "%Lp %N" "{{SECRETS_DIR}}"
  # Should be 700
  ls -la "{{SECRETS_DIR}}/"
else
  echo "No secrets directory found"
fi

echo "=== Config File ==="
if [ -f "{{CONFIG_DIR}}/config.env" ]; then
  stat -f "%Lp %N" "{{CONFIG_DIR}}/config.env"
  # Should be 600
else
  echo "No config.env found"
fi

Expected permissions:

Path	Expected	Reason
{{SECRETS_DIR}}/	700	Only owner can access secrets directory
{{CONFIG_DIR}}/config.env	600	Contains environment variables, may include keys
{{SECRETS_DIR}}/*	600	Individual secret files

3. Verify .gitignore coverage

echo "=== Gitignore Check ==="
MISSING=""

# Files that MUST be in .gitignore
REQUIRED_IGNORES=(
  "config.env"
  ".secrets/"
  "*.key"
  "*.pem"
  "node_modules/"
  ".env"
  ".env.*"
  "token.json"
)

for pattern in "${REQUIRED_IGNORES[@]}"; do
  if ! grep -q "$pattern" "{{PROJECT_ROOT}}/.gitignore" 2>/dev/null; then
    MISSING="$MISSING\n  MISSING: $pattern"
  fi
done

if [ -z "$MISSING" ]; then
  echo "All required patterns present"
else
  echo -e "GAPS FOUND:$MISSING"
fi