Команда security-audit

Security Audit

Perform comprehensive security assessment: $ARGUMENTS

Current Environment

• Dependency scan: !npm audit --audit-level=moderate 2>/dev/null || pip check 2>/dev/null || echo "No package manager detected"
• Environment files: @.env* (if exists)
• Security config: @.github/workflows/security.yml or @security/ (if exists)
• Recent commits: !git log --oneline --grep="security\|fix" -10

Task

Perform systematic security audit following these steps:

• Environment Setup
• Identify the technology stack and framework
• Check for existing security tools and configurations
• Review deployment and infrastructure setup

• Dependency Security
• Scan all dependencies for known vulnerabilities
• Check for outdated packages with security issues
• Review dependency sources and integrity
• Use appropriate tools: npm audit, pip check, cargo audit, etc.

• Authentication & Authorization
• Review authentication mechanisms and implementation
• Check for proper session management
• Verify authorization controls and access restrictions
• Examine password policies and storage

• Input Validation & Sanitization
• Check all user input validation and sanitization
• Look for SQL injection vulnerabilities
• Identify potential XSS (Cross-Site Scripting) issues
• Review file upload security and validation

• Data Protection
• Identify sensitive data handling practices
• Check encryption implementation for data at rest and in transit
• Review data masking and anonymization practices
• Verify secure communication protocols (HTTPS, TLS)

• Secrets Management
• Scan for hardcoded secrets, API keys, and passwords
• Check for proper secrets management practices
• Review environment variable security
• Identify exposed configuration files

• Error Handling & Logging
• Review error messages for information disclosure
• Check logging practices for security events
• Verify sensitive data is not logged
• Assess error handling robustness

• Infrastructure Security
• Review containerization security (Docker, etc.)
• Check CI/CD pipeline security
• Examine cloud configuration and permissions
• Assess network security configurations

• Security Headers & CORS
• Check security headers implementation
• Review CORS configuration
• Verify CSP (Content Security Policy) settings
• Examine cookie security attributes

• 10. Reporting
• Document all findings with severity levels (Critical, High, Medium, Low)
• Provide specific remediation steps for each issue
• Include code examples and file references
• Create an executive summary with key recommendations

Use automated security scanning tools when available and provide manual review for complex security patterns.