firstp1ck/pi-coding-agent-forge/code-security

# 1. Check for leaked secrets
grep -rn "sk-proj-\|sk-\|AKIA\|ghp_\|gho_\|github_pat_\|xoxb-\|xoxp-" --include="*.py" --include="*.ts" --include="*.js" --include="*.rs" --include="*.sh" --include="*.toml" --include="*.json" --include="*.yml" --include="*.yaml" --include="*.env" .
 
# 2. Check .gitignore covers sensitive files
cat .gitignore | grep -i "env\|secret\|key\|token\|credential"
 
# 3. Check for .env files in repo
find . -name ".env*" -not -path "./.git/*"
 
# 4. Run dependency audit (language-specific)
cargo audit          # Rust
npm audit            # JavaScript/TypeScript
pip-audit            # Python (via pip install pip-audit)

# Comprehensive secret scan across a repo
grep -rn \
    -e "sk-proj-" \
    -e "sk-[A-Za-z0-9]\{20,\}" \
    -e "AKIA[0-9A-Z]\{16\}" \
    -e "ghp_" \
    -e "gho_" \
    -e "github_pat_" \
    -e "xox[bpors]-" \
    -e "BEGIN.*PRIVATE KEY" \
    -e "password\s*=" \
    -e "api_key\s*=" \
    -e "secret\s*=" \
    --include="*.py" --include="*.ts" --include="*.js" --include="*.rs" \
    --include="*.sh" --include="*.toml" --include="*.json" --include="*.yml" \
    --include="*.yaml" --include="*.env" --include="*.cfg" --include="*.ini" \
    .

# Search git history for secrets (simplified)
git log --all -p | grep -n "sk-proj-\|AKIA\|ghp_\|BEGIN.*PRIVATE KEY"
 
# Check specific file history
git log --all -p -- "path/to/suspicious/file"

# Secrets and credentials
.env
.env.*
*.pem
*.key
credentials.json
service-account.json
**/secrets/
 
# IDE and editor files
.idea/
.vscode/settings.json
*.swp
 
# OS files
.DS_Store
Thumbs.db

# Install cargo-audit if not present
cargo install cargo-audit
 
# Run audit
cargo audit
 
# JSON output for parsing
cargo audit --json
 
# Fix by updating Cargo.lock
cargo update
cargo audit

# Run audit
npm audit
 
# Fix automatically where possible
npm audit fix
 
# Force fix (may include breaking changes)
npm audit fix --force
 
# JSON output
npm audit --json

# Install pip-audit
pip install pip-audit
 
# Audit current environment
pip-audit
 
# Audit a requirements file
pip-audit -r requirements.txt
 
# JSON output
pip-audit --format json

# Dangerous patterns
os.system(user_input)
subprocess.call(user_input, shell=True)
exec(user_input)
eval(user_input)

# Dangerous patterns
open(user_input)               # Unsanitized file path
os.path.join(base, user_input) # Without validation

# Dangerous patterns
f"SELECT * FROM users WHERE id = {user_input}"
cursor.execute("SELECT * FROM users WHERE id = " + user_input)

# Dangerous patterns
password = "hardcoded_value"
API_KEY = "sk-..."
conn_string = "postgres://user:pass@host/db"

# Check for unsafe blocks
grep -rn "unsafe" --include="*.rs" .
 
# Check for unwrap (potential panics)
grep -rn "\.unwrap()" --include="*.rs" .
 
# Run clippy with security lints
cargo clippy -- -W clippy::all

# Check for dangerous functions
grep -rn "eval\|exec\|os.system\|subprocess.call.*shell=True" --include="*.py" .
 
# Check for pickle (deserialization risk)
grep -rn "pickle\|cPickle" --include="*.py" .
 
# Run bandit (Python SAST)
pip install bandit
bandit -r . -f json

# Check for unquoted variables (injection risk)
# shellcheck is the best tool for this
shellcheck *.sh
 
# Check for eval with variables
grep -rn 'eval.*\$' --include="*.sh" .

# Code Security Report: [Repository Name]
 
**Date:** YYYY-MM-DD
**Analyst:** Zero
**Repository:** [path or URL]
**Commit:** [short hash]
 
## Summary
 
| Category | Critical | High | Medium | Low |
|---|---|---|---|---|
| Secrets | X | X | X | X |
| Dependencies | X | X | X | X |
| Code patterns | X | X | X | X |
 
## Findings
 
### Secrets
[List any found secrets with file:line references]
 
### Dependency Vulnerabilities
[List from cargo audit / npm audit / pip-audit]
 
### Code Vulnerabilities
[List from SAST scan with file:line references]
 
## Recommendations
 
1.[Prioritized actions]
 
## .gitignore Status
 
-[ ] Adequate for this project type
-[ ] Missing entries: [list]