Security Audit

Perform a comprehensive security review using OWASP Top 10 as a framework.

Scope

Target: $ARGUMENTS (or entire codebase if not specified)

Checklist

A01 — Broken Access Control

• [ ] Authorization checks on every protected route/endpoint
• [ ] Horizontal privilege escalation (can user A access user B's data?)
• [ ] IDOR (insecure direct object references) in API endpoints
• [ ] Missing authentication middleware

A02 — Cryptographic Failures

• [ ] Sensitive data stored/transmitted in plaintext
• [ ] Weak hash algorithms (MD5, SHA1 for passwords)
• [ ] Hardcoded secrets, API keys, or passwords in source
• [ ] TLS not enforced in production config

A03 — Injection

• [ ] SQL injection (raw queries with user input)
• [ ] Command injection (shell exec with user data)
• [ ] XSS (unsanitized HTML output)
• [ ] LDAP, NoSQL, XML injection

A04 — Insecure Design

• [ ] Missing rate limiting on auth endpoints
• [ ] No brute-force protection on login
• [ ] Sensitive operations lack confirmation step

A05 — Security Misconfiguration

• [ ] Debug mode enabled in production config
• [ ] Verbose error messages exposing internals
• [ ] Default credentials not changed
• [ ] Unnecessary services/ports exposed
• [ ] Missing security headers (CSP, HSTS, X-Frame-Options)

A06 — Vulnerable Components

npm audit
# or: pip-audit / safety check / snyk test

A07 — Authentication Failures

• [ ] Weak password policy
• [ ] Session tokens not invalidated on logout
• [ ] Missing MFA for sensitive operations
• [ ] JWT: algorithm confusion, weak secret, no expiry

A08 — Software Integrity Failures

• [ ] Subresource Integrity (SRI) for external scripts
• [ ] CI/CD pipeline integrity

A09 — Logging Failures

• [ ] Sensitive data logged (passwords, tokens, PII)
• [ ] Failed auth attempts not logged
• [ ] No audit trail for admin actions

A10 — Server-Side Request Forgery (SSRF)

• [ ] Unvalidated URL parameters used in server requests
• [ ] Internal network accessible via user-controlled URLs

Output Format

## Security Audit Report

### Critical (fix immediately)
- [file:line] VULN_TYPE — description + remediation

### High (fix before next release)
- [file:line] VULN_TYPE — description + remediation

### Medium (fix in next sprint)
- [file:line] VULN_TYPE — description

### Low / Informational
- [finding] — recommendation

### Dependency Vulnerabilities
[npm audit / pip-audit output summary]

### Score: X/10 critical issues found

$ARGUMENTS