plan-security-audit · diff
git:20260818.fdb3115 to git:20260819.a86e5d9
3 added, 3 removed. Audit A to A.
---
name: plan-security-audit
description: >
- OWASP Top 10 + Supabase-first hardening burndown (auth paths, dependency
- CVEs). Use when "security audit plan", "OWASP audit", "hardening plan", or
- "security burndown". Table RLS → plan-rls-audit. Key rotation →
+ OWASP Top 10 + Supabase-first hardening burndown. Use when "security audit
+ plan", "OWASP audit", "hardening plan", or "security burndown". App-layer
+ auth flows → audit-auth-flows. Table RLS → plan-rls-audit. Key rotation →
plan-secrets-audit. App LLM attacks → audit-llm-security.
license: MIT
---
# Security Audit + Hardening Plan
**Role:** Senior application security engineer.
**Task:** Exhaustive vulnerability audit (frontend, backend, auth, Supabase, deps, secrets),
mapped to OWASP Top 10, then remediation plan. **Audit & plan only — no code changes, no
destructive testing.**
## This skill vs neighbors
| Skill | Does |
|-------|------|
| **plan-security-audit** (this) | Plan with OWASP + Supabase-first burndown |
| `audit-security` | Static security review (may fix) |
| `test-red-team` | Adversarial runtime testing |
| `audit-db-schema` | Schema health including RLS review |
**Loop:** see `docs/PLAN-LOOPS.md` — after `plan-test-coverage`, parallel with `plan-perf-audit`, before `plan-docs-sync`
---
## ⛔ Preservation Contract
Read `references/preservation-contract.md`. Acknowledge in output #1.
**Safety guardrails:**
- No destructive/live exploit testing
- Never paste found secret values — location + type, flag for rotation
---
## References
| File | Contents |
|------|----------|
| `references/owasp-supabase-scope.md` | OWASP map, RLS-first methodology, scans |
| `references/output-templates.md` | Burndown, phased hardening, secrets list |
---
## Phase flow
```
1. Stack fingerprint
2. RLS-first pass (Supabase MCP if available)
3. Bundle/secret scan (no value echo)
4. Auth-path trace
5. Dependency CVE scan
6. OWASP remainder (injection, headers, misconfig)
7. Burndown + phased hardening plan
8. Guardrails + research citations
```
Sentry MCP: security-related production errors. Firecrawl: current OWASP + Supabase patterns.
---
## Phase 2 — RLS-first (Supabase)
Enumerate every `public` table:
- RLS enabled?
- Policies scope rows correctly?
- `WITH CHECK` on writes?
- Realtime respects SELECT policies?
**#1 critical class:** table without RLS + anon key in client = full data exposure.
Detail: `references/owasp-supabase-scope.md`
---
## Phase 3 — Bundle/secret scan
Inspect client bundle + source for:
- `service_role` key (Critical — full RLS bypass)
- Hardcoded API keys, DSNs
- `.env` committed / not gitignored
- Secrets in git history → **rotate** (history is forever)
Report: `file:line` + type only — **never the value**.
---
## Phase 4–6 — Auth, deps, OWASP
- Every protected route/endpoint → server-side enforcement?
- `npm audit`, lockfile versions vs CVE databases
- XSS, SQLi, SSRF, headers/CSP, rate limits
Map each finding to OWASP category.
---
## Burndown + hardening plan
Template: `references/output-templates.md`
Phases: Critical → High → Med/Low. Each remediation + "what must keep working".
Re-scan proposed after fixes (second pass).
---
## Required output (in order)
1. Preservation-contract acknowledgment
2. Stack fingerprint + scope
3. Per-area finding inventory
4. Burndown table (OWASP + evidence + severity)
5. Hardening + enhancement plan, phased
6. Guardrails/tooling (SCA CI, secrets manager, RLS tests)
7. Research notes + citations
8. Open questions / `[NEEDS VERIFICATION]` + secrets-to-rotate (locations only)
---
## Rules
- Plan only — no patches, no live/destructive testing.
- Every finding cites real evidence. Unconfirmed → `[NEEDS VERIFICATION]`.
- Never paste secret values.
- Never fabricate CVEs or exploits.
- Separate confirmed vulnerability vs hardening recommendation.