martinffx/code-security

Code Security

Security audit workflow and checklist.

The Workflow

1. Scan

Run automated security tools.

# Check dependencies
npm audit
pip audit
cargo audit

# Run security scanner
trivy fs .
snyk test

2. Review

Manual code review against checklist.

See references/owasp-top-10.md for common vulnerabilities.

3. Fix

Remediate vulnerabilities found.

4. Verify

Re-scan to confirm fixes.

---

Security Checklist

Injection

| Check | Pattern | |-------|---------| | SQL | Parameterized queries | | Command | No shell execution with user input | | XSS | Escape/validate output | | LDAP | Escape DN components |

Authentication

| Check | Pattern | |-------|---------| | Passwords | Hash with bcrypt/argon2 | | Sessions | Secure, httpOnly cookies | | Tokens | Short-lived, proper validation | | MFA | Consider for sensitive ops |

Data Protection

| Check | Pattern | |-------|---------| | Secrets | Never in code | | PII | Encrypt at rest | | Transport | HTTPS only | | Logs | No sensitive data |

Dependencies

| Check | Pattern | |-------|---------| | Vulnerabilities | Scan regularly | | Outdated | Update promptly | | Sources | Trusted packages only |

---

Common Vulnerabilities

See references/vulnerability-patterns.md for detailed patterns:

SQL Injection

# BAD
query = f"SELECT * FROM users WHERE id = {user_id}"

# GOOD
query = "SELECT * FROM users WHERE id = %s"
cursor.execute(query, (user_id,))

XSS

// BAD
element.innerHTML = userInput;

// GOOD
element.textContent = userInput;
// or
element.setAttribute('title', sanitize(userInput))

Command Injection

# BAD
os.system(f"ping {host}")

# GOOD
subprocess.run(['ping', host])

Hardcoded Secrets

// BAD
const apiKey = "sk_live_12345";

// GOOD (environment variable)
const apiKey = process.env.API_KEY;

---

Tools

See references/security-tools.md for setup and usage:

| Tool | Ecosystem | Purpose | |------|-----------|---------| | npm audit | Node.js | Dependency vulnerabilities | | pip-audit | Python | Dependency vulnerabilities | | cargo-audit | Rust | Dependency vulnerabilities | | Snyk | Multi | Vulnerability scanning | | Trivy | Multi | Container/infra scanning | | OWASP ZAP | Multi | Web app scanning | | bandit | Python | Static analysis | | ESLint security | JS/TS | Static analysis |

---

Output Format

After security audit:

## Security Audit

### Scan Results
- Dependencies: 0 vulnerabilities
- Static analysis: 1 issue found

### Issues Found

| Severity | Issue | Location | Fix |
|----------|-------|----------|-----|
| High | SQL injection | users.py:42 | Use parameterized query |
| Medium | Hardcoded secret | config.js:5 | Use env var |

### Recommendations
1. Enable 2FA for admin accounts
2. Rotate API keys quarterly
3. Set up automated dependency scanning

---

Skill Loading

• For database issues → load python-sqlalchemy or typescript-drizzle-orm
• For auth issues → load relevant auth patterns
• For deployment security → load infra skills if available