audit-infra

Infrastructure Audit

Cross-cutting infrastructure audit covering secrets management, Docker configuration, dependency security, CORS, webhook security, migration rollback safety, CI/CD, logging, and monitoring.

Detection Strategy

Auto-detect infrastructure components by scanning for:

• docker-compose.yml / Dockerfile — containerized services
• .github/workflows/ / .gitlab-ci.yml / Jenkinsfile — CI/CD pipelines
• *.env* files — environment configuration
• migrations/ — database migration files
• nginx.conf / caddy / reverse proxy configs
• package.json / go.mod / requirements.txt — dependency manifests

Checks

1. Secrets in Repository

Grep across all source (excluding .env.example, docs, and test fixtures):

• API keys: (?:api[_-]?key|apikey)\s*[:=]\s*["'][A-Za-z0-9]{16,}["']
• Passwords: password\s*[:=]\s*["'][^"']{4,}["']
• Private keys: -----BEGIN.*PRIVATE KEY-----
• Connection strings with credentials: ://[^:]+:[^@]+@
• Generic tokens: (?:secret|token|jwt_secret)\s*[:=]\s*["'][A-Za-z0-9]{16,}["'] Also check: .env files committed to git (git ls-files '*.env') FAIL for any real credentials in tracked source files.

2. .env.example Completeness

Extract all environment variable references from source code:

• Go: os\.Getenv\("([^"]+)"\)|viper\.Get.*\("([^"]+)"\)
• JS/TS: process\.env\.([A-Z_]+)|import\.meta\.env\.([A-Z_]+)
• Python: os\.environ\[["']([^"']+)["']\]|os\.getenv\(["']([^"']+)["']\) Cross-reference against .env.example or .env.project.example. WARN for environment variables referenced in code but missing from example files.

3. Docker Non-Root Execution

Read all Dockerfile files. Check:

• USER directive present (not running as root)?
• Base image is specific version (not :latest)?
• No secrets in build args or ENV directives?
• Multi-stage builds used to minimize image size? WARN for root execution. WARN for :latest base images.

4. Dependency Vulnerabilities

# npm projects
find . -name "package.json" -not -path "*/node_modules/*" -maxdepth 3 -execdir npm audit --production 2>/dev/null \; | grep -E "critical|high|moderate" | head -20
# Go projects
find . -name "go.mod" -maxdepth 3 -execdir sh -c 'command -v govulncheck >/dev/null && govulncheck ./... 2>&1 | tail -10 || echo "govulncheck not installed"' \;
# Python projects
find . -name "requirements.txt" -maxdepth 3 -execdir sh -c 'command -v pip-audit >/dev/null && pip-audit 2>&1 | tail -10 || echo "pip-audit not installed"' \;

FAIL for critical/high. WARN for moderate.