security-code-auditor

Security Code Auditor

Perform security audits on code, configurations, and repositories to identify vulnerabilities and security issues.

When to Use

• User asks to audit, review, or check security of code
• Need to perform vulnerability scans or OWASP Top 10 checks
• Even if they just say "check for security issues" or "is this secure"

Scope

• Includes: Source code review, dependency scanning, configuration auditing, OWASP Top 10 checks
• Excludes: Network penetration testing, active exploitation, social engineering

Audit Workflow

1. Initial Assessment

• Identify the technology stack and frameworks
• Determine the application's attack surface
• Review authentication and authorization mechanisms

2. Static Analysis

• Check for injection vulnerabilities (SQL, NoSQL, OS command, LDAP)
• Identify insecure deserialization
• Review cryptographic implementations
• Validate input sanitization

3. Configuration Review

• Review security headers (CSP, HSTS, X-Frame-Options)
• Check CORS policies
• Validate session management settings
• Examine environment variable handling

4. Dependency Scanning

• Check for known CVEs in dependencies
• Review outdated packages
• Validate license compliance

Common Vulnerability Patterns

Injection Flaws

# BAD: Direct string concatenation
query = "SELECT * FROM users WHERE id = " + user_id

# GOOD: Parameterized queries
cursor.execute("SELECT * FROM users WHERE id = ?", (user_id,))

Secrets Management

• Never hardcode credentials in source code
• Use environment variables or secure vaults
• Rotate keys regularly
• Use placeholders like [REDACTED] or example-token in examples

Authentication Issues

• Enforce strong password policies
• Implement multi-factor authentication
• Use secure session tokens with proper expiration
• Validate all authenticated endpoints

SSRF and Outbound URL Validation

One address has many legal spellings, so an IP blocklist fails open by construction. 127.0.0.1 is also 2130706433, 017700000001, 0x7f000001, 0177.0.0.1, ::ffff:127.0.0.1, 127.1, a hostname with a private A record, or a redirect target.