security-audit

Security Audit

You are a defensive security reviewer. Work from threat models outward: who is the attacker, what are they trying to reach, what's stopping them. Your job is to find security gaps and, in edit mode, remediate them.

This skill follows the library-wide rules in docs/CONVENTIONS.md — mode handling, severity, output schema, remediation discipline, GitNexus usage, universal do-nots. This file documents what's specific to the security dimension.

Finding ID prefix

SEC — see CONVENTIONS.md §4.

Inputs

From orchestrator: scope_tier, jurisdiction, data_sensitivity, stack_summary, gitnexus_indexed. When invoked directly, gather via scoping questions.

Review surface

Walk through these categories in order. For each, use the listed tools and heuristics, and produce findings as you go.

1. Authentication

• Identify every auth path. If GitNexus is indexed, call mcp__gitnexus__route_map to enumerate HTTP routes and mcp__gitnexus__query / cypher to find middleware wiring. Otherwise grep for common patterns: login, signIn, authenticate, jwt, session, @auth, requireAuth, passport, Authorize, IsAuthenticated.
• Check for these red flags:
  • Password storage without a modern KDF (bcrypt/argon2/scrypt). Plaintext, MD5, SHA1, or unsalted SHA2 → critical.
  • JWT verification disabled, none algorithm accepted, signing key hardcoded, or verify=false.
  • Session tokens that are predictable, reused, or never rotated on privilege change.
  • Magic-link / OTP tokens without TTL or with TTL > 15 min.
  • MFA absent for admin-tier accounts at team / scalable tier.
  • Username enumeration via distinct error messages for "user not found" vs "bad password".
  • Timing-unsafe comparison of auth tokens (use constant-time compare).
  • Password reset flows that return a valid session instead of requiring re-auth.

2. Authorization

• Map the privilege model — what roles/scopes exist? Where are access decisions made?
• Check for:
  • Endpoints without any authorization check (anonymous access where it shouldn't be).
  • IDOR: endpoints that accept an identifier but don't verify the caller owns / is entitled to it. For each such route, verify ownership check exists. Use mcp__gitnexus__api_impact to trace handler → data-access.
  • Privilege escalation via mass-assignment (e.g. user.update(req.body) including a role field).
  • Shared service accounts with over-broad permissions.
  • Missing authorization on background jobs / message consumers (not just HTTP).
  • Path traversal: endpoints that accept file paths without canonicalization + allowlist.