security-review

Security Review

A systematic security audit that finds real vulnerabilities — not theoretical ones. Prioritizes by blast radius.

When to Use

• Before any code ships to production
• When adding authentication, file upload, payments, or user data handling
• Reviewing a PR that touches auth, APIs, or data access
• Auditing a new codebase you inherited

The Audit Checklist

Work through these in order — critical first.

1. Secrets and Credentials

The easiest win. Scan first.

# Quick scan for likely secrets
grep -rE "(api_key|secret|password|token|credential)\s*=\s*['\"][^'\"]{8,}" . --include="*.py" --include="*.js" --include="*.ts" --include="*.env"
git log --all --full-history -- "**/*.env" "**/.env*"

Findings:

• No secrets hardcoded in source files
• No secrets in git history
• .env files are in .gitignore
• Secrets loaded from environment variables or a secrets manager (AWS Secrets Manager, Vault)

Severity: CRITICAL — hardcoded secrets are actively exploited within hours of being pushed.

2. Injection Vulnerabilities

SQL Injection — look for string concatenation in queries:

# VULNERABLE
query = f"SELECT * FROM users WHERE email = '{email}'"
cursor.execute(query)

# SAFE
cursor.execute("SELECT * FROM users WHERE email = %s", (email,))

Command Injection — look for user input in shell commands:

# VULNERABLE
os.system(f"ffmpeg -i {user_filename} output.mp4")
subprocess.call(f"convert {path}", shell=True)

# SAFE
subprocess.run(["ffmpeg", "-i", user_filename, "output.mp4"])

NoSQL Injection — look for unvalidated objects passed to MongoDB queries.

Template Injection — look for user strings rendered as templates (Jinja2, Handlebars).

Severity: CRITICAL for SQL/command injection. HIGH for others.

3. Authentication and Authorization

Authentication (who are you?):

• Passwords hashed with bcrypt/argon2 (never MD5, SHA1, or plain SHA256)
• JWT secrets are strong (≥256 bits) and not hardcoded
• JWT expiry is set (exp claim checked)
• Sessions invalidated on logout
• Rate limiting on login and password reset endpoints