security-audit

Security Auditing Workflow

Systematic security review using static analysis tools available in the codebase. Covers OWASP Top 10, secrets exposure, auth patterns, and dependency risk.

Phase 1: Reconnaissance — Map the Attack Surface

1. Identify entry points — list all routes/controllers:

   grep -rn "app\.\(get\|post\|put\|delete\|patch\)\|@app\.route\|router\." src/ --include="*.{js,ts,py}" | head -60
   

2. Identify auth middleware — check which routes are protected:

   grep -rn "auth\|middleware\|guard\|require_login\|jwt\|bearer" src/ -i --include="*.{js,ts,py}" | head -40
   

3. Map external dependencies — check package files for known-risky libs:

   cat package.json 2>/dev/null || cat requirements.txt 2>/dev/null || cat go.mod 2>/dev/null
   

4. Note findings — list: total endpoints found, unprotected routes, third-party auth libs.

---

Phase 2: Secrets & Sensitive Data Exposure

1. Scan for hardcoded secrets:

   grep -rn "password\s*=\s*['\"][^'\"]\|api_key\s*=\s*['\"][^'\"]\|secret\s*=\s*['\"][^'\"]" src/ -i | grep -v ".example" | head -30
   

2. Scan for tokens/keys in source:

   grep -rEn "(sk-|AIza|AKIA|ghp_|xox[baprs]-)[A-Za-z0-9]+" src/ | head -20
   

3. Check .env files are gitignored:

   cat .gitignore | grep -i "\.env" ; ls -la .env* 2>/dev/null
   

4. Check for secrets in logs:

   grep -rn "console\.log.*password\|logger.*token\|print.*secret" src/ -i | head -20
   

Flag: any hardcoded credential or unignored .env file is a P0 finding.

---

Phase 3: Injection & Input Validation

1. SQL injection risk — look for string concatenation in queries:

   grep -rn "query.*+\|execute.*f\"\|raw.*%s\|SELECT.*\$\{" src/ --include="*.{js,ts,py}" | head -30
   

2. Command injection risk — shell execution with user input:

   grep -rn "exec(\|spawn(\|subprocess\|os\.system\|child_process" src/ --include="*.{js,ts,py}" | head -20