code-security

Code Security

Secret scanning, dependency vulnerability auditing, static analysis patterns, and supply chain security for the user's codebases.

Quick Start

Quick Repo Security Check

Run these in order for any repository:

# 1. Check for leaked secrets
grep -rn "sk-proj-\|sk-\|AKIA\|ghp_\|gho_\|github_pat_\|xoxb-\|xoxp-" --include="*.py" --include="*.ts" --include="*.js" --include="*.rs" --include="*.sh" --include="*.toml" --include="*.json" --include="*.yml" --include="*.yaml" --include="*.env" .

# 2. Check .gitignore covers sensitive files
cat .gitignore | grep -i "env\|secret\|key\|token\|credential"

# 3. Check for .env files in repo
find . -name ".env*" -not -path "./.git/*"

# 4. Run dependency audit (language-specific)
cargo audit          # Rust
npm audit            # JavaScript/TypeScript
pip-audit            # Python (via pip install pip-audit)

---

Secret Scanning

Patterns to Detect

Pattern	Regex	Severity
OpenAI API key	sk-proj-[A-Za-z0-9_-]{20,}	Critical
OpenAI legacy key	sk-[A-Za-z0-9]{20,}	Critical
AWS access key	AKIA[0-9A-Z]{16}	Critical
GitHub PAT	ghp_[A-Za-z0-9]{36}	Critical
GitHub OAuth	gho_[A-Za-z0-9]{36}	Critical
GitHub App token	github_pat_[A-Za-z0-9_]{22,}	Critical
Slack token	xox[bpors]-[A-Za-z0-9-]{10,}	High
Telegram bot token	[0-9]{8,10}:AA[A-Za-z0-9_-]{33}	High
Discord bot token	[MN][A-Za-z0-9]{23,}\.[A-Za-z0-9_-]{6}\.[A-Za-z0-9_-]{27,}	High
JWT token	eyJ[A-Za-z0-9_-]*\.eyJ[A-Za-z0-9_-]*\.[A-Za-z0-9_-]*	High
Generic API key	[Aa]pi[_-]?[Kk]ey.*[=:]\s*["'][A-Za-z0-9]{20,}	Medium
Password in URL	://[^:]+:[^@]+@	High
Private key header	`-----BEGIN (RSA	EC
Password assignment	[Pp]assword\s*[=:]\s*["'][^"']{8,}	High

Manual Secret Scan

# Comprehensive secret scan across a repo
grep -rn \
    -e "sk-proj-" \
    -e "sk-[A-Za-z0-9]\{20,\}" \
    -e "AKIA[0-9A-Z]\{16\}" \
    -e "ghp_" \
    -e "gho_" \
    -e "github_pat_" \
    -e "xox[bpors]-" \
    -e "BEGIN.*PRIVATE KEY" \
    -e "password\s*=" \
    -e "api_key\s*=" \
    -e "secret\s*=" \
    --include="*.py" --include="*.ts" --include="*.js" --include="*.rs" \
    --include="*.sh" --include="*.toml" --include="*.json" --include="*.yml" \
    --include="*.yaml" --include="*.env" --include="*.cfg" --include="*.ini" \
    .