common-security-audit ยท diff
git:20260423.b7ed028 to git:20260520.ca51455
32 added, 32 removed. Audit A to A.
---
name: common-security-audit
- description: Probe for hardcoded secrets, injection surfaces, unguarded routes, and infrastructure weaknesses across Node, Go, Dart, Java, Python, and Rust codebases. Use when performing security audits, vulnerability scans, secrets detection, or penetration testing.
+ description: Probe for hardcoded secrets, injection surfaces, unguarded routes, business logic flaws, and platform-specific weaknesses across backend (Node, Go, Java, Python, Rust), frontend (React, Angular, Vue), and mobile (iOS, Android, Flutter) codebases. Use when performing security audits, vulnerability scans, secrets detection, or penetration testing.
metadata:
triggers:
files:
- 'package.json'
- 'go.mod'
- 'pubspec.yaml'
- 'pom.xml'
+ - 'Cargo.toml'
+ - 'requirements.txt'
+ - 'AndroidManifest.xml'
+ - 'Info.plist'
keywords:
- Dockerfile
- security audit
- vulnerability scan
- secrets detection
- injection probe
- pentest
---
# Security Audit
## **Priority: P0 (CRITICAL)**
## 1. Scan for Hardcoded Secrets
See [implementation examples](references/implementation.md) for secrets scanning commands.
- ## 2. Detect Data Leakage in Logs
-
- Identify sensitive info printed to logs or stdout.
+ Covers: Backend source, frontend bundles (`REACT_APP_`, `NEXT_PUBLIC_`, `VITE_`), mobile configs (`BuildConfig`, `Info.plist`, `strings.xml`).
- - **Node/TS**: `grep -rE "console\.(log|error|warn)" . --include="*.ts" --include="*.js" | grep -iE "password|token|secret"`
- - **Go**: `grep -rE "log\.(Print|Printf|Println|Fatal)" . --include="*.go" | grep -iE "password|token|secret"`
- - **Dart/Flutter**: `grep -rE "print\(|debugPrint\(" . --include="*.dart" | grep -iE "password|token|secret"`
- - **Java/Spring**: `grep -rE "log(ger)?\.(info|debug|warn|error)" . --include="*.java" | grep -iE "password|token|secret"`
+ ## 2. Detect Data Leakage in Logs
- ## 3. Map Injection Surfaces
+ See [implementation examples](references/implementation.md) for log leakage scanning commands across Node, Go, Dart, Java, Swift.
- Detect raw string concatenation in queries or system commands.
+ ## 3. Map Injection Surfaces & Auth Coverage
- See [implementation examples](references/implementation.md) for injection surface detection.
+ See [implementation examples](references/implementation.md) for injection detection and auth coverage measurement.
- ## 4. Measure Auth Coverage vs Exposure
+ ## 4. Run Dependency CVE Scans
- Compare total routes against protected endpoints.
+ - **Node/Python/Rust**: `npm audit --audit-level=high` | `pip-audit` | `cargo audit`
+ - **Go/Dart**: `go list -m -u all` | `dart pub outdated --json`
+ - **Java/Mobile**: `mvn dependency:list` / `./gradlew dependencies` | `pod audit` / Gradle scan
- - **NestJS**: `total=$(grep -r "@(Get|Post|Put|Delete|Patch)" . | wc -l); guarded=$(grep -r "@(UseGuards|Auth)" . | wc -l)`
- - **Spring**: `total=$(grep -r "@(GetMapping|PostMapping|PutMapping)" . | wc -l); guarded=$(grep -r "@(PreAuthorize|Secured)" . | wc -l)`
- - **Go**: `total=$(grep -rE "(GET|POST|PUT|DELETE)" . | wc -l); guarded=$(grep -rE "(middleware|auth|jwt|guard)" . | wc -l)`
+ ## 5. Infrastructure & Adversarial Entry Points
- ## 5. Run Dependency CVE Scans
+ See [implementation examples](references/implementation.md) for RCE/SSRF/Path Traversal and infrastructure hardening (Docker/K8s).
- - **Node**: `npm audit --audit-level=high`
- - **Dart/Flutter**: `dart pub outdated --json`
- - **Go**: `go list -m -u all | grep "\["`
- - **Java**: `mvn dependency:list` or `./gradlew dependencies`
- - **Python**: `pip-audit`
- - **Rust**: `cargo audit`
+ ## 6. Frontend-Specific Audit
- ## 6. Audit Infrastructure Hardening
+ - **Exposed Secrets**: `grep -rE "(REACT_APP_|NEXT_PUBLIC_|VITE_)" . --include="*.ts*" --include="*.env*"`
+ - **DOM Sinks & Source Maps**: Check `dangerouslySetInnerHTML`, `innerHTML`, `eval`, and `.map` files in prod builds.
- See [implementation examples](references/implementation.md) for infrastructure hardening checks.
+ ## 7. Mobile-Specific Audit
- ## 7. Detect Adversarial Entry Points (RCE/SSRF/Path Traversal)
+ See [mobile audit commands](references/mobile-audit.md) for insecure storage (Keychain/Keystore), cert pinning, debug flags, and deep links.
- Identify where user input reaches dangerous sinks without sanitization.
+ ## 8. Business Logic & Advanced Attacks
- - **Path Traversal**: `grep -rE "path\.join\(|os\.path\.join\(" . | grep -vE "path\.resolve|path\.normalize"`
- - **SSRF**: `grep -rE "axios\.get\(|http\.Get\(|fetch\(" . | grep -vE "['\"]https?://" `
- - **BOLA/IDOR**: `grep -rE "findById\(|findOne\(" . | grep -viE "tenant|owner|user_id"`
+ - **BOLA/IDOR**: Verify entity lookups always enforce tenant/owner ownership checks (e.g. any `findById` without an `owner` filter is a P0 IDOR vulnerability).
+ - **JWT / Mass Assignment**: Check missing `exp`, weak keys, and uncontrolled property spread (`...req.body`).
+ - **Race / GraphQL**: Verify atomic DB transactions, introspection disabled, and query depth limits.
## Scoring Impact
| Finding | Threshold | Severity | Deduction |
- | ------------------------ | --------- | -------- | --------- |
+ | --- | --- | --- | --- |
| Hardcoded Secrets | Any match | P0 | -25 |
| Plain-text PII in Logs | Any match | P0 | -20 |
| Unguarded Routes > 20% | > 0.2 | P0 | -15 |
| Raw SQL Concatenation | Any match | P1 | -10 |
| Response Leakage (Stack) | > 0 | P1 | -10 |
+ | Insecure Mobile Storage | Token in plaintext | P1 | -15 |
+ | Missing Cert Pinning | No pinning detected | P2 | -8 |
+ | DOM XSS Sinks | Any match | P1 | -10 |
- > **CAUTION**: P0 finding immediately caps Security score at 40/100.
+ > **CAUTION**: P0 finding immediately caps Security score at 40/100. Immediate actions for leaked secrets: rotate the credential NOW and purge from history.
## Anti-Patterns
- **No applying generic patterns over project-specific rules**: Respect existing security constraints.
- **No ignoring error handling or edge cases**: Audit must cover boundary conditions.
+ - **No backend-only audit**: Always check frontend AND mobile when in-scope.
## References
- [Vulnerability Remediation Protocols](references/REMEDIATION.md)
+ - [Mobile Audit Commands](references/mobile-audit.md)