Security Audit

Identify vulnerabilities and implement secure coding practices.

When to Use

• Security review of code or architecture
• Implementing authentication/authorization
• Before deploying to production
• User asks about security best practices
• Handling sensitive data

OWASP Top 10 Checklist

1. Injection - Parameterized queries, input sanitization
2. Broken Auth - Strong sessions, MFA, secure password storage
3. Sensitive Data - Encryption at rest and transit, minimal exposure
4. XXE - Disable external entities, use JSON over XML
5. Broken Access Control - RBAC, deny by default
6. Misconfiguration - Secure defaults, remove debug info
7. XSS - Output encoding, CSP headers
8. Insecure Deserialization - Validate input, avoid native serialization
9. Vulnerable Components - Dependency scanning, updates
10. Logging - Audit logs, no sensitive data in logs

Security Headers

Content-Security-Policy: default-src 'self'
X-Content-Type-Options: nosniff
X-Frame-Options: DENY
Strict-Transport-Security: max-age=31536000; includeSubDomains

Auth Implementation

// Password hashing
const hash = await bcrypt.hash(password, 12);

// JWT with short expiry
const token = jwt.sign({ userId }, secret, { expiresIn: "15m" });

// Refresh token rotation
const refreshToken = crypto.randomBytes(32).toString("hex");

Audit Output Format

## Security Audit Report

**Severity Levels:** Critical | High | Medium | Low

### Critical

- [Issue]: [Description] → [Fix]

### High

- [Issue]: [Description] → [Fix]

### Recommendations

- [Improvement suggestion]

Examples

Input: "Review auth implementation" Action: Check password storage, session management, token handling, report findings

Input: "Make this API secure" Action: Add input validation, auth checks, rate limiting, security headers