neuromechanist/research-skills/security-audit

Security Audit

Systematic security review of a project covering dependency vulnerabilities, credential exposure, common code vulnerabilities, and configuration hardening.

When to Use

• Before a release or deployment
• After adding new dependencies
• When onboarding to a new codebase
• Periodic security reviews
• After receiving a vulnerability report

Audit Checklist

1. Credential and Secret Scanning

Check for exposed secrets in the codebase:

# Check for common secret patterns in tracked files
git grep -n -i -E '(api_key|apikey|secret|password|token|credential|private_key)\s*[:=]' -- ':!*.md' ':!*.lock'
 
# Check for .env files tracked in git
git ls-files | grep -i '\.env'
 
# Check .gitignore covers sensitive files
for f in .env .env.local credentials.json secrets.yaml; do
  git check-ignore "$f" 2>/dev/null || echo "WARNING: $f not in .gitignore"
done

Files that must never be committed:

• .env, .env.* (environment variables)
• credentials.json, service-account.json (cloud credentials)
• *.pem, *.key (private keys)
• *.p12, *.pfx (certificates with private keys)

2. Dependency Vulnerability Scan

Python:

uv run pip-audit

JavaScript/TypeScript:

bun pm audit
# or check with npm for broader database
npm audit --omit=dev

Go:

govulncheck ./...

Review results against the severity rubric (shared with the dependency-auditor agent):

• Critical: exploitable now or actively exploited (leaked live credential,

known-exploited CVE in a reachable path). Must fix before release; blocks release-prep.

• High: known vulnerability with a plausible attack path. Fix before the next

release.

• Medium: vulnerability with mitigating factors, or a major-version lag on a

security-relevant package. Fix within the sprint.

• Low: outdated without known vulnerabilities; license concerns to review.

Track in backlog.

3. Code Vulnerability Patterns

Scan for common vulnerability patterns:

SQL Injection:

# Look for string interpolation in SQL
grep -rn 'f".*SELECT\|f".*INSERT\|f".*UPDATE\|f".*DELETE' --include='*.py'
grep -rn "format.*SELECT\|format.*INSERT" --include='*.py'

Command Injection:

# Look for shell=True or unsanitized subprocess calls
grep -rn 'shell=True\|os\.system\|subprocess\.call.*shell' --include='*.py'
grep -rn 'exec(\|eval(' --include='*.py' --include='*.js' --include='*.ts'

XSS (Cross-Site Scripting):

# Look for dangerouslySetInnerHTML or unescaped output
grep -rn 'dangerouslySetInnerHTML\|innerHTML\s*=' --include='*.tsx' --include='*.jsx' --include='*.ts' --include='*.js'

Path Traversal:

grep -rn 'open(.*\+\|os\.path\.join.*input\|req\.\(params\|query\|body\)' --include='*.py' --include='*.js'

4. Authentication and Authorization

Review:

• [ ] Authentication endpoints use constant-time comparison for secrets
• [ ] Session tokens have appropriate expiration
• [ ] CORS configuration is restrictive (not * in production)
• [ ] Rate limiting on auth endpoints
• [ ] Password hashing uses bcrypt/argon2 (not MD5/SHA1)

5. Configuration Hardening

• [ ] Debug mode disabled in production configs
• [ ] HTTPS enforced (HSTS headers)
• [ ] Security headers present (CSP, X-Frame-Options, X-Content-Type-Options)
• [ ] Error messages do not leak stack traces in production
• [ ] Logging does not include sensitive data (passwords, tokens)

6. Docker Security (if applicable)

• [ ] Non-root user in Dockerfile
• [ ] Base image is pinned to specific version (not latest)
• [ ] No secrets in Docker build args or layers
• [ ] Health checks configured
• [ ] Read-only filesystem where possible

7. CI/CD Security

• [ ] Secrets stored in GitHub Secrets (not in workflow files)
• [ ] Third-party actions pinned to SHA (not tags)
• [ ] Minimal permissions in workflow permissions: block
• [ ] No pull_request_target with actions/checkout of PR head

Output Format

Present findings as a prioritized list:

## Security Audit Results
 
### Critical (must fix)
1. [CRED] API key found in src/config.py:42 - move to environment variable
2. [DEP] lodash 4.17.20 has prototype pollution (CVE-2021-23337)
 
### High (fix before release)
3. [CODE] SQL injection risk in src/db.py:88 - use parameterized queries
 
### Medium (fix within sprint)
4. [CONFIG] CORS allows * origin in production config
 
### Low (backlog)
5. [STYLE] Error responses include stack traces in non-debug mode
 
### Passed
- [x] No .env files in git
- [x] Docker runs as non-root
- [x] Dependencies up to date

Additional Resources

• Reference: references/owasp-top-10.md - OWASP Top 10 checklist with project-specific examples
• Reference: references/secret-management.md - How to manage secrets across environments