security-audit

Security Audit

When to use this skill

• Auditing a codebase for security vulnerabilities
• Reviewing authentication and authorization
• Checking for exposed secrets or credentials
• Assessing dependency security
• Hardening an application before deployment
• Responding to security alerts

Step 1: Secrets and credentials scan

# Search for hardcoded secrets
grep -rn "password\s*=\|api_key\s*=\|secret\s*=\|token\s*=" --include="*.ts" --include="*.py" --include="*.js" --include="*.env" .
grep -rn "AKIA[0-9A-Z]\{16\}" .  # AWS access keys
grep -rn "sk-[a-zA-Z0-9]\{20,\}" .  # API keys (OpenAI, Stripe, etc.)
grep -rn "ghp_[a-zA-Z0-9]\{36\}" .  # GitHub personal access tokens

# Check for .env files in git
git ls-files | grep -i "\.env"

# Check .gitignore covers sensitive files
cat .gitignore | grep -i "env\|secret\|key\|credential"

Findings to flag:

• Any credential in source code (even in comments)
• .env files tracked by git
• Missing .gitignore entries for sensitive files

Step 2: Input validation (Injection attacks)

SQL Injection

# Find raw SQL queries
grep -rn "query(\`\|query(f\"\|execute(f\"\|\.raw(" --include="*.ts" --include="*.py" --include="*.js" .
grep -rn "\$\{.*\}" --include="*.sql" .

// VULNERABLE
db.query(`SELECT * FROM users WHERE id = ${userId}`);

// SAFE: Parameterized query
db.query('SELECT * FROM users WHERE id = $1', [userId]);

XSS (Cross-Site Scripting)

# Find dangerous HTML injection
grep -rn "innerHTML\|dangerouslySetInnerHTML\|v-html\|\|html(" --include="*.tsx" --include="*.jsx" --include="*.vue" --include="*.html" .

// VULNERABLE
element.innerHTML = userInput;
<div dangerouslySetInnerHTML={{ __html: userContent }} />

// SAFE
element.textContent = userInput;
// Or sanitize: DOMPurify.sanitize(userContent)

Command Injection

# Find shell command execution
grep -rn "exec(\|spawn(\|execSync(\|child_process\|subprocess\|os\.system\|os\.popen" --include="*.ts" --include="*.py" --include="*.js" .