/security-scan

Deep security analysis of an entire codebase in a single pass.

Philosophy

Traditional security scanning is file-by-file. It misses cross-file vulnerabilities: data flows from user input through multiple modules to a dangerous sink. With Opus 4.6's 1M token context, we load the entire project and trace attack surfaces end-to-end.

This is NOT a replacement for dedicated SAST/DAST tools. It's a complementary analysis that catches what those tools miss: logic flaws, auth bypasses, business logic vulnerabilities, and cross-module data flow issues.

Process

1. Load Full Codebase

# Estimate token count
find . -name "*.ts" -o -name "*.tsx" -o -name "*.js" -o -name "*.jsx" -o -name "*.py" -o -name "*.go" -o -name "*.rs" -o -name "*.rb" | \
  grep -v node_modules | grep -v .next | grep -v dist | grep -v build | \
  xargs wc -l 2>/dev/null | tail -1

If under ~200K lines: load everything into context via full file reads. If over: focus on the attack surface (auth, API routes, data access, user input handlers).

2. Map Attack Surface

Read ALL of these file categories:

Entry points: API routes, webhooks, form handlers, CLI commands
Auth/authz: Middleware, guards, session management, JWT handling
Data access: Database queries, ORM models, raw SQL
User input: Form validation, request parsing, file uploads
External integrations: API clients, webhook handlers, OAuth flows
Secrets management: env var usage, config files, .env patterns
Infrastructure: Dockerfile, CI/CD workflows, deployment configs

3. Vulnerability Analysis

Spawn security-sentinel agent with the full diff/codebase context. Analyze for:

OWASP Top 10:

A01: Broken Access Control — missing auth checks, IDOR, privilege escalation
A02: Cryptographic Failures — weak hashing, plaintext secrets, insecure transport
A03: Injection — SQL, NoSQL, OS command, LDAP, XSS
A04: Insecure Design — business logic flaws, missing rate limiting
A05: Security Misconfiguration — default creds, verbose errors, open CORS
A06: Vulnerable Components — outdated deps with known CVEs
A07: Auth Failures — weak passwords, missing MFA, session issues
A08: Software/Data Integrity — unsigned updates, insecure deserialization
A09: Logging Failures — missing audit trails, sensitive data in logs
A10: SSRF — unvalidated URLs, internal network access

Cross-Module Analysis (unique to 1M context):

Trace user input from entry point through all transformations to sink
Identify auth bypass paths across middleware chains
Find data exposure through API response serialization
Detect race conditions in concurrent operations
Map trust boundary violations across service calls

4. Dependency Audit

# npm/pnpm
pnpm audit 2>/dev/null || npm audit 2>/dev/null

# Python
pip-audit 2>/dev/null || safety check 2>/dev/null

# Go
govulncheck ./... 2>/dev/null

# Rust
cargo audit 2>/dev/null

5. Secrets Scan

# Check for hardcoded secrets
grep -rn "sk_live\|sk_test\|AKIA\|password\s*=\s*['\"]" --include="*.ts" --include="*.js" --include="*.py" --include="*.go" . | grep -v node_modules | grep -v ".env.example"

# Check .env files not in .gitignore
git ls-files --cached | grep -i "\.env$" | head -5

Output Format

## Security Scan: [project-name]

**Scope:** [X files, Y lines analyzed]
**Effort:** max
**Date:** [timestamp]

---

### Critical (Immediate Fix Required)
- [ ] `file:line` — [Vulnerability type] — [Description] — [Exploit path]

### High (Fix Before Deploy)
- [ ] `file:line` — [Vulnerability type] — [Description]

### Medium (Fix in Sprint)
- [ ] `file:line` — [Vulnerability type] — [Description]

### Low (Track and Fix)
- [ ] `file:line` — [Vulnerability type] — [Description]

### Dependency Vulnerabilities
| Package | Version | CVE | Severity | Fix Version |
|---------|---------|-----|----------|-------------|

### Cross-Module Findings
- [Data flow from X through Y to Z creates injection risk]
- [Auth middleware skipped on route A when accessed via B]

### Positive Observations
- [Good security patterns found]
- [Well-implemented auth flows]

When to Use

Before any production deployment
After adding new API routes or auth logic
When integrating new external services
During quarterly security reviews
After dependency updates

/check-quality — Includes lightweight security scan
/review-branch — security-sentinel is mandatory reviewer
/billing-security — Payment-specific security patterns

security-scan