copilot-dev: Command for Claude Code

Perform a thorough security scan of the following code:

Code to scan: ${selection}

If no code is selected, scan the file at: ${file}

If neither is provided, ask for the code or file path to analyze.

---

Scan methodology

Work through each category below systematically. For every finding, report:

[SEVERITY] Category: Vulnerability name
  File: path/to/file  Line(s): N-M
  Finding: What the vulnerable code does
  Risk: What an attacker could do with this
  Code (current):
    [the vulnerable snippet]
  Remediation:
    [the fixed version with explanation]

Severity levels:

• CRITICAL — exploitable remotely, immediate data breach or system compromise risk
• HIGH — serious vulnerability requiring prompt attention
• MEDIUM — defense-in-depth issue or vulnerability requiring specific conditions
• LOW — best practice violation, minor hardening opportunity
• INFO — observation worth noting but not a vulnerability

---

Category 1: Hardcoded secrets

Scan for any secrets, credentials, or sensitive values embedded directly in source code:

Look for patterns like:

• API keys, tokens, passwords assigned to variables
• Connection strings with embedded credentials
• JWT secrets, encryption keys, salts
• AWS/Azure/GCP credentials (AKIA..., ARM tokens, service account keys)
• OAuth client secrets
• Private keys (-----BEGIN RSA PRIVATE KEY-----)

# CRITICAL — hardcoded secret
API_KEY = "sk-proj-AbCdEf1234567890"         # OpenAI key exposed
DB_PASSWORD = "MyS3cr3tP@ssw0rd!"            # Database credential

# PASS — environment variable
API_KEY = os.environ.get("OPENAI_API_KEY")
if not API_KEY:
    raise ValueError("OPENAI_API_KEY environment variable not set")

Common secret patterns to flag:

• password = "..." or pwd = "..."
• secret = "..." or api_key = "..."
• token = "..." (unless clearly a placeholder)
• Long alphanumeric strings in assignments (possible keys)
• Base64-encoded strings in config values