security-audit

What this skill does

# Security Audit Skill

When auditing code for security, follow this structured process. Treat every finding seriously — a single vulnerability can compromise an entire system.

## 1. Secrets & Credentials

Scan the entire codebase for exposed secrets:

- **Hardcoded API keys, tokens, passwords** in source code
- **Secrets in config files** committed to Git (.env, config.json, settings.py)
- **Secrets in logs** — sensitive data printed in console.log, logger.info, etc.
- **Secrets in error messages** — stack traces or error responses leaking internals
- **Secrets in comments** — old credentials left in TODO or commented-out code
- **Secrets in Git history** — check if secrets were committed and later removed (still in history)

Check commands:
```bash
# Search for common secret patterns
grep -rn "password\|secret\|api_key\|apikey\|token\|private_key\|AWS_SECRET\|DATABASE_URL" --include="*.ts" --include="*.js" --include="*.py" --include="*.env" --include="*.json" --include="*.yaml" --include="*.yml" .

# Check for .env files committed
git ls-files | grep -i "\.env"

# Check git history for secrets
git log --all --diff-filter=D -- "*.env" "*.pem" "*.key"
```

Verify:
- Is a `.gitignore` in place with `.env`, `*.pem`, `*.key`, `*.p12`?
- Are secrets loaded from environment variables or a vault (not files)?
- Is there a `.env.example` with placeholder values (not real secrets)?

## 2. Injection Attacks

### SQL Injection
```
// 🔴 VULNERABLE — string concatenation in query
const user = await db.query(`SELECT * FROM users WHERE id = '${req.params.id}'`);

// ✅ SAFE — parameterized query
const user = await db.query('SELECT * FROM users WHERE id = $1', [req.params.id]);
```

### NoSQL Injection
```
// 🔴 VULNERABLE — user input directly in query object
const user = await User.find({ username: req.body.username });

// ✅ SAFE — explicitly cast to string
const user = await User.find({ username: String(req.body.username) });
```

### Command Injection
```
// 🔴 VULNERABLE — user input in shell command
exec(`convert ${req.body.filename} output.png`);

// ✅ SAFE — use execFile with arguments array
execFile('convert', [sanitizedFilename, 'output.png']);
```

### XSS (Cross-Site Scripting)
```
// 🔴 VULNERABLE — unsanitized HTML rendering
element.innerHTML = userInput;
// React: dangerouslySetInnerHTML={{ __html: userInput }}

// ✅ SAFE — use textContent or sanitize
element.textContent = userInput;
// React: use DOMPurify.sanitize() before dangerouslySetInnerHTML
```

### Path Traversal
```
// 🔴 VULNERABLE — user controls file path
const file = fs.readFileSync(`./uploads/${req.params.filename}`);

// ✅ SAFE — resolve and validate path stays within allowed directory
const safePath = path.resolve('./uploads', req.params.filename);
if (!safePath.startsWith(path.resolve('./uploads'))) throw new Error('Invalid path');
```

### Template Injection
- Check for user input passed directly into template engines (Jinja2, EJS, Handlebars)
- Verify auto-escaping is enabled

## 3. Authentication & Authorization

### Authentication Flaws
- **Weak password requirements** — no minimum length, complexity, or breach checking
- **Missing rate limiting** on login endpoints (brute force risk)
- **Missing account lockout** after failed attempts
- **Insecure password storage** — plaintext, MD5, SHA1 (use bcrypt/argon2 with proper cost)
- **Missing MFA** on sensitive operations
- **Session tokens in URLs** — tokens should be in headers or httpOnly cookies
- **No session expiration** — tokens that never expire

### Authorization Flaws
- **Missing authorization checks** — endpoints accessible without verifying user permissions
- **IDOR (Insecure Direct Object Reference)** — accessing other users' data by changing an ID
- **Privilege escalation** — regular user can access admin endpoints
- **Missing resource ownership checks** — user A can modify user B's data
```
// 🔴 VULNERABLE — IDOR: no ownership check
app.get('/api/orders/:id', async (req, res) => {
  const order = await Order.findById(req.params.id);
  res.json(order);
});

// ✅ SAFE — verify ownership
app.get('/api/orders/:id', async (req, res) => {
  const order = await Order.findById(req.params.id);
  if (order.userId !== req.user.id) return res.status(403).json({ error: 'Forbidden' });
  res.json(order);
});
```

## 4. Data Exposure

- **Sensitive data in API responses** — returning passwords, tokens, SSNs, full credit card numbers
- **Verbose error messages** in production — stack traces, database details, internal paths
- **Missing field filtering** — returning entire database objects instead of specific fields
- **Sensitive data in client-side storage** — tokens in localStorage (use httpOnly cookies)
- **PII in logs** — names, emails, IPs logged without redaction
- **Missing data encryption** — sensitive data stored unencrypted at rest
- **CORS misconfiguration** — `Access-Control-Allow-Origin: *` on authenticated endpoints
```
// 🔴 VULNERABLE — leaking sensitive fields
res.json(user);

// ✅ SAFE — explicit field selection
res.json({
  id: user.id,
  name: user.name,
  email: user.email,
});
```

## 5. Input Validation

- **Missing validation** — no checks on request body, params, query strings
- **Type confusion** — expecting a number but accepting a string
- **Missing length limits** — unbounded input that could cause DoS
- **Missing file upload validation** — no checks on file type, size, or content
- **Regex DoS (ReDoS)** — catastrophic backtracking on malicious input
- **Missing content-type validation** — accepting unexpected content types

Verify:
- Is there a validation library in use (Zod, Joi, class-validator, Pydantic)?
- Are all API endpoints validating input before processing?
- Are file uploads restricted by type, size, and scanned for malware?

## 6. Dependencies

Run these checks:
```bash
# Node.js
npm audit
# or
npx better-npm-audit audit

# Python
pip audit
# or
safety check

# Check for outdated packages
npm outdated
pip list --outdated
```

Look for:
- **Known CVEs** in dependencies
- **Outdated packages** with known vulnerabilities
- **Abandoned packages** — no updates in 2+ years
- **Typosquatting risk** — verify package names are correct
- **Excessive permissions** — packages requesting more access than needed
- **Lockfile present** — package-lock.json or yarn.lock committed

## 7. HTTP Security Headers

Check if these headers are set:
- `Content-Security-Policy` — prevents XSS and data injection
- `Strict-Transport-Security` — enforces HTTPS
- `X-Content-Type-Options: nosniff` — prevents MIME type sniffing
- `X-Frame-Options: DENY` — prevents clickjacking
- `Referrer-Policy` — controls referrer information
- `Permissions-Policy` — restricts browser features
```bash
# Check response headers
curl -I https://your-app.com
```

## 8. Cryptography

- **Weak hashing** — MD5 or SHA1 for passwords (use bcrypt, scrypt, or argon2)
- **Weak encryption** — DES, RC4, ECB mode (use AES-256-GCM)
- **Hardcoded encryption keys** — keys should be in environment variables or a vault
- **Missing TLS** — HTTP connections for sensitive data
- **Weak JWT** — using `alg: none` or HS256 with a short secret
- **Predictable random values** — using Math.random() for tokens (use crypto.randomBytes)
```
// 🔴 VULNERABLE — predictable token
const token = Math.random().toString(36);

// ✅ SAFE — cryptographically secure
const token = crypto.randomBytes(32).toString('hex');
```

## 9. Infrastructure & Configuration

- **Debug mode in production** — verbose errors, stack traces, debug endpoints
- **Default credentials** — admin/admin, root/root still active
- **Unnecessary ports open** — database ports exposed to the internet
- **Missing rate limiting** — no protection against DoS
- **Missing request size limits** — large payloads causing OOM
- **Insecure CORS** — wildcard origins on authenticated endpoints
- **Missing CSRF protection** — state-changing endpoints without CSRF tokens

## 10. Stack-Specific Checks

### Node.js / Express