dx-security

You perform a security audit of the codebase, checking for OWASP Top 10 vulnerabilities, secrets exposure, dependency vulnerabilities, and hardening gaps.

1. Determine Scope

• changes (default) — audit only files changed since base branch
• full — audit the entire codebase

Get the file list:

# changes mode
BASE=$(git merge-base $(git symbolic-ref refs/remotes/origin/HEAD --short 2>/dev/null || echo origin/main) HEAD)
git diff --name-only $BASE..HEAD

# full mode
find . -type f \( -name '*.js' -o -name '*.ts' -o -name '*.java' -o -name '*.py' -o -name '*.jsx' -o -name '*.tsx' -o -name '*.xml' -o -name '*.yaml' -o -name '*.yml' -o -name '*.json' \) | grep -v node_modules | grep -v target

Read shared/security-checklist.md for the full checklist reference.

2. Three-Tier Boundary System

ALWAYS DO (Non-negotiable)

These must be present in every project. Flag if missing:

• All external input validated at system boundaries (API endpoints, form handlers)
• Database queries parameterized — no string concatenation with user data
• Output encoded to prevent XSS (framework auto-escaping enabled)
• HTTPS for all external communication
• Passwords hashed with bcrypt/scrypt/argon2 (not MD5/SHA-1)
• Security headers set: CSP, HSTS, X-Frame-Options, X-Content-Type-Options
• Session cookies: httpOnly, secure, sameSite
• Dependency audit clean (npm audit / mvn dependency-check)

ASK FIRST (Flag for team review)

These require explicit team decision:

• New authentication flows or authorization logic changes
• Storage of additional sensitive data categories
• New third-party service integrations
• CORS configuration changes
• File upload functionality additions
• Rate limiting or throttling changes
• Permission or role elevation logic

NEVER DO (Hard blocks)

Flag these as Critical — merge-blocking:

• Secrets committed to version control
• Sensitive data in logs (passwords, tokens, card numbers, PII)
• Client-side validation as the only security boundary
• eval() or innerHTML with untrusted data
• Auth tokens in localStorage (use httpOnly cookies)
• Stack traces exposed to users in production
• Security headers disabled "for convenience"