oks-citadel/security-review

Security Review Skill — Flamoral Platform

Trigger Conditions

• Before any deployment (dev/staging/prod)
• On any new dependency addition
• On any auth/IAM change
• On any API endpoint creation/modification
• Weekly scheduled audit

Scan Checklist

1. Secrets Detection

• Scan all files for hardcoded API keys, passwords, tokens
• Check .env files are gitignored
• Verify AWS credentials not in source
• Verify Stripe keys not in frontend code
• Tools: trufflehog, git secrets, manual grep

2. Dependency Vulnerabilities

npm audit --audit-level=critical
npm audit --audit-level=high

• Block on CRITICAL severity
• Warn on HIGH severity
• Document MEDIUM for next sprint

3. Auth Flow Validation

• [ ] JWT stored in httpOnly cookies only
• [ ] Cognito tokens never in response body
• [ ] Token refresh uses secure cookie exchange
• [ ] Session invalidation on logout
• [ ] Password requirements: 12+ chars, complexity
• [ ] Age verification (18+) enforced
• [ ] Rate limiting on auth endpoints (10 req/min)
• [ ] CSRF protection enabled
• [ ] Password breach check (HaveIBeenPwned)

4. OWASP Top 10

• [ ] A01: Broken Access Control — role-based checks on all endpoints
• [ ] A02: Cryptographic Failures — TLS everywhere, strong hashing
• [ ] A03: Injection — parameterized queries, input sanitization
• [ ] A04: Insecure Design — threat modeling for new features
• [ ] A05: Security Misconfiguration — CSP, CORS, headers
• [ ] A06: Vulnerable Components — npm audit clean
• [ ] A07: Auth Failures — covered in auth flow above
• [ ] A08: Data Integrity — signed JWTs, integrity checks
• [ ] A09: Logging — security events logged with correlationId
• [ ] A10: SSRF — no user-controlled URLs in server requests

5. GDPR Compliance

• [ ] Consent collection (terms + privacy) on registration
• [ ] Data export endpoint available
• [ ] Account deletion with data purge
• [ ] Data minimization — only collect what's needed
• [ ] Privacy policy accessible

6. Infrastructure Security

• [ ] CSP headers in CloudFront response headers policy
• [ ] HTTPS enforced (HSTS)
• [ ] S3 buckets not public
• [ ] ECS tasks use least-privilege IAM roles
• [ ] Redis requires authentication
• [ ] PostgreSQL SSL connections

Output Format

### Security Audit Report — [timestamp]
- Secrets Scan: CLEAN / [count] FOUND
- Dependencies: [critical] CRITICAL / [high] HIGH / [medium] MEDIUM
- Auth Flow: PASS / FAIL (details)
- OWASP: [X/10] checks passing
- GDPR: COMPLIANT / NON-COMPLIANT (details)
- Infrastructure: PASS / FAIL (details)
- Verdict: DEPLOY / BLOCK
- Remediation: [ordered list of fixes]