version: "1.0.0" name: security-scan description: > Rapid security scanning workflow for code changes. Activates a focused security sweep. Activate when: security scan, scan for vulnerabilities, check for secrets, security check, run security audit, check deps. argument-hint: "[path or scope to scan — defaults to recent git changes]"

Security Scan

Rapid security sweep for code changes. Faster than a full /review — focused on security only.

When to Use

• Before committing code that touches auth, user input, data storage, or external APIs
• After adding new dependencies
• Quick pre-PR security gate

Scan Protocol

Step 1: Determine Scope

# Default: scan recent changes
git diff --name-only HEAD~1
 
# Or use provided path

Step 2: Secrets Scan

# Scan for common secret patterns
grep -rn --include="*.{ts,js,py,go,rs,java,cs,yaml,json,env,sh,toml}" \
  -e "sk-[A-Za-z0-9]\{32,\}" \
  -e "ghp_[A-Za-z0-9]\{36\}" \
  -e "AKIA[0-9A-Z]\{16\}" \
  -e "api.key\s*=\s*['\"][^'\"]\{8,\}" \
  -e "password\s*=\s*['\"][^'\"]\{4,\}" \
  -e "secret\s*=\s*['\"][^'\"]\{8,\}" \
  .
 
# Check .env is in .gitignore
cat .gitignore | grep -E "\.env$|\.env\."

CRITICAL: Any match in committed code = immediate blocker.

Step 3: Dependency Audit

Run language-appropriate audit:

# Node.js
npm audit --audit-level=high
 
# Python
pip-audit  # or: safety check
 
# Rust
cargo audit
 
# Go
govulncheck ./...
 
# Java/Maven
mvn dependency-check:check

Report: Count of critical/high severity CVEs and their package names.

Step 4: Input Validation Spot-Check

For changed files that handle user input (API endpoints, form handlers, CLI args):

• Is input validated/sanitized before use?
• Are SQL queries parameterized (no string concatenation)?
• Is HTML output escaped before rendering?
• Are file paths sanitized (no ../ traversal)?

Step 5: Auth/Authz Quick Check

For changed files touching auth:

• Is authentication checked BEFORE authorization?
• Are authorization checks on EVERY relevant endpoint?
• Are JWT tokens validated (algorithm + signature + expiry)?
• Are session cookies HttpOnly; Secure; SameSite=Strict?

Output Format

## Security Scan Report
 
**Scope:** [files scanned]
**Date:** [timestamp]
 
### Secrets
- [ ] No hardcoded secrets found
- ⚠ Found: [file:line — description]
 
### Dependencies
- Critical CVEs: X
- High CVEs: Y
- Packages: [list if any]
 
### Input Validation
- [ ] User inputs sanitized in changed files
- ⚠ Risk: [file:line — description]
 
### Auth
- [ ] Auth/authz checks present on relevant routes
- ⚠ Risk: [file:line — description]
 
### Verdict
CLEAN / NEEDS ATTENTION / BLOCKER
 
### Next Steps
- [Action items with file:line references]

Severity Quick Reference

See Also

• @security-reviewer — comprehensive OWASP Top 10 security review
• /review — full code review including security
• /coding-standards — baseline code quality rules