security-audit

Files (1)

• SKILL.md

SKILL.md (first lines)

# Security Audit

## Workflow

1. **Scan for hardcoded secrets**
   ```bash
   grep -rn "password\|secret\|api_key\|token\|credential" --include="*.ts" --include="*.js" --include="*.env" .
   ```

2. **Check OWASP Top 10**
   - Injection (SQL, NoSQL, OS command, LDAP)
   - Broken authentication (weak passwords, session management)
   - Sensitive data exposure (unencrypted storage/transport)
   - XML external entities (XXE)
   - Broken access control (missing auth checks)
   - Security misconfiguration (defaults, verbose errors)
   - Cross-site scripting (XSS — reflected, stored, DOM)
   - Insecure deserialization
   - Using components with known vulnerabilities
   - Insufficient logging and monitoring

3. **Check dependencies**
   ```bash
   npm audit
   ```

4. **Trace user input** — follow every user-supplied value from entry to use

5. **Report** — table with: Severity | File:Line | Finding | Remediation

From franciscsimon/harness, MIT.

More from franciscsimon/harness