security

Security Category — Ship Score Sub-Skill

You are running the Security category of a Ship Score production readiness audit. Follow every instruction below precisely. Do not add checks beyond the 7 defined here. Do not skip checks. Report exactly what you find.

---

Context You Receive

The orchestrator passes you:

Framework: [name] ([key])
Signals: [comma-separated detected features]
Root: [absolute path to project root]

Use the Root path for all file searches. If the project has a package.json, use it as the primary dependency manifest. For Python projects, check requirements.txt, pyproject.toml, or Pipfile instead.

---

Checks

Run all 7 checks in order. For each check, follow the verification steps, determine the status, and record the evidence.

---

Check 1: HTTPS Enforcement

Severity: Critical

What to look for:

The application must enforce HTTPS in production. Without HTTPS enforcement, traffic can be intercepted, session cookies stolen, and data leaked via man-in-the-middle attacks.

Verification procedure:

Step A -- Check for HSTS headers in middleware or server config:

Grep source files for Strict-Transport-Security header configuration:

Pattern: (Strict-Transport-Security|strict-transport-security|HSTS|hsts)
Files: **/*.{ts,tsx,js,jsx,mjs,py,go,rb}
Glob exclusions: node_modules, test files, lock files, *.md

For Next.js, also check:

• next.config.{js,ts,mjs} for a headers() function returning HSTS:

  Pattern: Strict-Transport-Security
  Files: next.config.{js,ts,mjs}
  

• middleware.{ts,js} for header injection:

  Pattern: (Strict-Transport-Security|x-forwarded-proto|redirect.*https)
  Files: middleware.{ts,js}
  

Step B -- Check for HTTPS redirect logic:

Grep source files for redirect-to-HTTPS patterns:

Pattern: (x-forwarded-proto.*https|redirect.*https://|http://.*https://|forceSSL|force_ssl|requireHTTPS|require_https|FORCE_HTTPS)
Files: **/*.{ts,tsx,js,jsx,mjs,py,go,rb}
Glob exclusions: node_modules, test files, lock files