Security Audit

Perform comprehensive security assessment: $ARGUMENTS

Current Environment

• Dependency scan: !npm audit --audit-level=moderate 2>/dev/null || pip check 2>/dev/null || echo "No package manager detected"
• Environment files: @.env* (if exists)
• Security config: @.github/workflows/security.yml or @security/ (if exists)
• Recent commits: !git log --oneline --grep="security\|fix" -10

Task

Perform systematic security audit following these steps:

• Environment Setup

- Identify the technology stack and framework

- Check for existing security tools and configurations

- Review deployment and infrastructure setup

• Dependency Security

- Scan all dependencies for known vulnerabilities

- Check for outdated packages with security issues

- Review dependency sources and integrity

- Use appropriate tools: npm audit, pip check, cargo audit, etc.

• Authentication & Authorization

- Review authentication mechanisms and implementation

- Check for proper session management

- Verify authorization controls and access restrictions

- Examine password policies and storage

• Input Validation & Sanitization

- Check all user input validation and sanitization

- Look for SQL injection vulnerabilities

- Identify potential XSS (Cross-Site Scripting) issues

- Review file upload security and validation

• Data Protection

- Identify sensitive data handling practices

- Check encryption implementation for data at rest and in transit

- Review data masking and anonymization practices

- Verify secure communication protocols (HTTPS, TLS)

• Secrets Management

- Scan for hardcoded secrets, API keys, and passwords

- Check for proper secrets management practices

- Review environment variable security

- Identify exposed configuration files

• Error Handling & Logging

- Review error messages for information disclosure

- Check logging practices for security events

- Verify sensitive data is not logged

- Assess error handling robustness

• Infrastructure Security

- Review containerization security (Docker, etc.)

- Check CI/CD pipeline security

- Examine cloud configuration and permissions

- Assess network security configurations

• Security Headers & CORS

- Check security headers implementation

- Review CORS configuration

- Verify CSP (Content Security Policy) settings

- Examine cookie security attributes

• Reporting

- Document all findings with severity levels (Critical, High, Medium, Low)

- Provide specific remediation steps for each issue

- Include code examples and file references

- Create an executive summary with key recommendations

Use automated security scanning tools when available and provide manual review for complex security patterns.