Security quick audit

Rapid security assessment focused on OWASP Top 10 vulnerabilities.

Purpose

Perform a quick security scan to identify common vulnerabilities:

• Hardcoded secrets and credentials
• SQL injection risks
• XSS vulnerabilities
• Insecure dependencies
• Authentication/authorization issues

Instructions

Step 1: Secrets scan

# Common secret patterns
grep -rn --include="*.{js,ts,py,go,java,rb,php,env}" \
  -E "(password|secret|api_key|apikey|token|auth|credential).*[=:].*['\"][^'\"]{8,}['\"]" \
  --exclude-dir={node_modules,vendor,.git,dist,build} . 2>/dev/null | head -20

# .env files that might be committed
find . -name ".env*" -not -path "*/node_modules/*" -type f 2>/dev/null

# Check if secrets are gitignored
[ -f ".gitignore" ] && grep -q "\.env" .gitignore && echo "✅ .env in .gitignore" || echo "⚠️ .env NOT in .gitignore"

Step 2: Injection vulnerabilities

# SQL injection patterns (raw queries with string concat)
grep -rn --include="*.{js,ts,py,go,java,php}" \
  -E "(query|execute|raw|sql).*\+.*\$|f['\"].*SELECT|\.format\(.*SELECT" \
  --exclude-dir={node_modules,vendor,.git} . 2>/dev/null | head -15

# Command injection patterns
grep -rn --include="*.{js,ts,py,go,rb,php}" \
  -E "(exec|spawn|system|shell_exec|popen)\s*\(" \
  --exclude-dir={node_modules,vendor,.git} . 2>/dev/null | head -15

Step 3: XSS patterns

# Dangerous innerHTML/dangerouslySetInnerHTML usage
grep -rn --include="*.{js,ts,jsx,tsx,vue}" \
  -E "(innerHTML|dangerouslySetInnerHTML|v-html)" \
  --exclude-dir={node_modules,.git,dist} . 2>/dev/null | head -15

# Unescaped template literals in HTML context
grep -rn --include="*.{js,ts,jsx,tsx}" \
  -E "\`.*\$\{.*\}.*<" \
  --exclude-dir={node_modules,.git,dist} . 2>/dev/null | head -10

Step 4: Dependency check

# Check for known vulnerabilities in npm packages
[ -f "package-lock.json" ] && npm audit --json 2>/dev/null | jq '{vulnerabilities: .metadata.vulnerabilities}' 2>/dev/null

# Check for outdated packages with security issues
[ -f "package.json" ] && npm outdated --json 2>/dev/null | jq 'to_entries | map(select(.value.current != .value.latest)) | length' 2>/dev/null

Step 5: Auth & session issues

# Hardcoded JWT secrets
grep -rn --include="*.{js,ts,py,go}" \
  -E "(jwt|JWT).*secret.*[=:].*['\"].{8,}['\"]" \
  --exclude-dir={node_modules,vendor,.git} . 2>/dev/null

# Missing CSRF protection patterns
grep -rn --include="*.{js,ts,py}" \
  -E "(POST|PUT|DELETE|PATCH).*fetch|axios\.(post|put|delete|patch)" \
  --exclude-dir={node_modules,vendor,.git} . 2>/dev/null | head -10

Output format

---

🛡️ Security audit report

Scan Date: [timestamp] Scope: [directory scanned]

🔴 Critical issues

Issue	Location	Description
[type]	[file:line]	[brief description]

🟠 High severity

Issue	Location	Recommendation
[type]	[file:line]	[fix suggestion]

🟡 Medium severity

Issue	Location	Note
[type]	[file:line]	[context]

📊 Summary

• Critical: X issues
• High: X issues
• Medium: X issues
• Dependencies: X vulnerabilities

🔧 Quick fixes

1. [Highest priority fix with command/code]
2. [Second priority]
3. [Third priority]

---

Severity levels

Level	Examples	Action
🔴 Critical	Hardcoded prod secrets, SQL injection	Fix immediately
🟠 High	Missing auth, XSS vectors	Fix before deploy
🟡 Medium	Outdated deps, missing CSRF	Plan remediation
🟢 Low	Best practice violations	Track for improvement

Usage

Full audit:

/security

Focus on specific area:

/security auth
/security deps
/security injection

Specific file/directory:

/security src/api/

Notes

• This is a quick heuristic scan, not a comprehensive security audit
• For production systems, complement with dedicated tools (Snyk, SonarQube, OWASP ZAP)
• False positives are possible - verify findings manually
• See examples/hooks/security-hooks.sh for automated pre-commit security checks

$ARGUMENTS