security-scan

Security Scan

Runs a comprehensive security audit covering dependency vulnerabilities, code patterns, and secret detection.

---

Execution Flow

Step 1: Detect Project Type

[ -f "package.json" ] && echo "NODE"
[ -f "requirements.txt" ] || [ -f "pyproject.toml" ] && echo "PYTHON"
[ -f "go.mod" ] && echo "GO"
[ -f "Cargo.toml" ] && echo "RUST"
[ -f "Gemfile" ] && echo "RUBY"

---

Step 2: Run Scans by Scope

Scope: {{scope}} (default: all)

deps - Dependency Vulnerabilities

# Node.js
npm audit --json 2>/dev/null

# Python
pip audit 2>/dev/null || safety check 2>/dev/null

# Go
govulncheck ./... 2>/dev/null

# Rust
cargo audit 2>/dev/null

Report format:

Dependency Vulnerabilities
--------------------------
CRITICAL (2):
  - [email protected] - Prototype Pollution (CVE-2021-23337)
    Fix: npm install [email protected]
  - [email protected] - Open Redirect (CVE-2024-XXXX)
    Fix: npm install [email protected]

HIGH (1):
  - [email protected] - Algorithm Confusion (CVE-2022-23529)
    Fix: npm install [email protected]

MODERATE (3):
  ...

code - Code Pattern Analysis

Scan source code for common vulnerability patterns using the Grep tool:

Injection Vulnerabilities:

• SQL Injection: string concatenation or template literals in database queries
• XSS: use of innerHTML, unsafe HTML rendering in frameworks, v-html directives
• Command Injection: spawning shell processes with unsanitized user input, subprocess with shell=True, unsafe system calls

Authentication Issues:

• Hardcoded credentials: password/secret string literal assignments in source
• Weak crypto: usage of md5 or sha1 for security-sensitive operations
• Insecure randomness: Math.random used for tokens or secrets
• Missing auth decorators: public route annotations on sensitive endpoints

Data Exposure:

• Sensitive data in logs: password/token/secret in logging calls
• CORS misconfiguration: wildcard origins, overly permissive CORS settings
• Missing security headers: no Content-Security-Policy, no X-Frame-Options