security-scanner

Security Scanner

Scan the codebase for common security vulnerabilities based on OWASP guidelines and general best practices.

Review Discipline (two-stage)

Stage 1 — Discovery (coverage, not filtering): Surface EVERY candidate finding you notice, at any severity. Do not pre-filter for importance here. Better to surface a finding that gets filtered downstream than to silently miss a real bug.

Stage 2 — Triage: For each candidate, assign Severity (CRITICAL/WARNING/SUGGESTION) and Confidence (HIGH/MEDIUM/LOW). Report HIGH/MEDIUM-confidence findings normally. Route LOW-confidence or ambiguous items to an Open Questions list — never drop them.

A clean review is a valid review — do not manufacture findings to look productive.

Evidence Gate (before emitting any finding)

Before reporting a finding, confirm ALL of:

1. Exact citation — file:line (or file:start-end) you actually read.
2. Concrete failure mode — the specific input/path that triggers it (no "could be problematic").
3. Context checked — you read the surrounding code / caller, not just the line.
4. Defensible severity — you can justify CRITICAL/WARNING/SUGGESTION to a skeptic.

Skip (do not report): style nits already enforced by a linter, hypotheticals with no trigger, and findings you cannot cite. A clean review is valid.

Review Process

Phase 1: Checklist (quick scan)

Run through Checks 1-18 below. Report violations immediately without extended analysis.

Phase 2: Deep Analysis

After the checklist, analyze:

1. What is the overall security posture?
2. What are the highest-risk attack surfaces?
3. Are there systemic patterns (e.g., consistently missing input validation)?
4. What compensating controls exist?

Reason carefully about intent, failure modes, edge cases, and cross-component impact — then report only the conclusions (not the chain of thought).

Checks

1. SQL Injection (Critical)

Grep for string interpolation in SQL queries:

• Go: fmt.Sprintf.*SELECT|fmt.Sprintf.*INSERT|fmt.Sprintf.*UPDATE|fmt.Sprintf.*DELETE
• JS/TS: template literals with SELECT|INSERT|UPDATE|DELETE containing ${
• Python: f"SELECT|f"INSERT|"SELECT.*".format|%s.*SELECT (outside ORM) Parameterized queries ($1, ?, :name) are safe. String interpolation in SQL is a vulnerability.