qa-security

Security Audit

Objective

Identify security vulnerabilities based on OWASP Top 10.

Instructions

1. Automated scan

# npm dependency audit
npm audit --audit-level=moderate

# Secret search
npx secretlint "**/*"

# Static security analysis
npx eslint --plugin security src/

2. OWASP Top 10 Checklist

A01 - Broken Access Control

• Authorization checks on every endpoint
• No IDOR (direct access via predictable IDs)
• CORS correctly configured
• Principle of least privilege

A02 - Cryptographic Failures

• Sensitive data encrypted (at rest + in transit)
• No secrets in code
• Secure hash algorithms (bcrypt, argon2)
• TLS/HTTPS enforced

A03 - Injection

• SQL: Parameterized queries / ORM
• XSS: HTML output escaping
• Command injection: No shell with user input
• NoSQL: Query validation

A04 - Insecure Design

• Server-side validation (not just client)
• Rate limiting on sensitive endpoints
• Environment separation

A05 - Security Misconfiguration

• Security headers (CSP, X-Frame-Options)
• No stack traces in production
• Correct file permissions

A06 - Vulnerable Components

• npm audit with no critical vulnerabilities
• Dependencies maintained and up to date

A07 - Authentication Failures

• Passwords hashed correctly
• Protection against brute force
• Secure sessions (httpOnly, secure, sameSite)

A08 - Data Integrity Failures

• Validation of incoming data
• Secure deserialization

A09 - Logging Failures

• Logs of security events
• No sensitive data in logs

A10 - SSRF

• Validation of user URLs
• Whitelist of allowed domains

3. Search patterns

# Potential secrets
grep -rn "password\s*=" --include="*.ts"
grep -rn "api_key\s*=" --include="*.ts"
grep -rn "secret\s*=" --include="*.ts"

# Potential SQL Injection
grep -rn "query.*\$\{" --include="*.ts"
grep -rn "execute.*\+" --include="*.ts"

# Potential XSS
grep -rn "innerHTML" --include="*.tsx"
grep -rn "dangerouslySetInnerHTML" --include="*.tsx"

# Dangerous eval
grep -rn "eval(" --include="*.ts"
grep -rn "new Function(" --include="*.ts"