security-audit

Files (2)

• SKILL.md
• run_audit.py · scripts/

SKILL.md (first lines)

# Security Audit Protocol

A structured, risk-centric framework for software security assessment. Designed for iterative human engagement with explicit checkpoints at each phase.

> **Adversarial path anchor.** This lens is invoked on the Verification Dual's adversarial path ([rules.md](../../rules.md) §2 Invariant 1): when no deterministic evaluator can close a security-correctness condition, context-free agents using this protocol supply the decorrelated review. See [skills/refine/SKILL.md](../refine/SKILL.md) AUDIT §"Sibling Skills Consultation" for the wiring point.

> **Core Principle:** The goal is not to maximize bug count, but to identify **business risk**, **architectural flaws**, and **exploitable logic errors**.

---

## Prime Directives

Before beginning, internalize these cognitive framings:

1. **Risk > Findings:** A bug is only a finding if it poses risk to business logic or data integrity. Context determines severity.

2. **Adversarial Mindset:** Analyze every input, endpoint, and public function assuming a capable adversary is attempting to subvert the system.

3. **Taint Analysis Model:** For every potential vulnerability, trace:
   - **Source:** Where does data enter? (user input, API body, URL param)
   - **Sink:** Where is it executed? (SQL query, `eval()`, HTML render, shell)
   - **Sanitizer:** Is there validation between Source and Sink? If not, it's a vulnerability.

4. **Assurance Spectrum:**
   - _Standard code:_ Pattern matching, control flow analysis
   - _Crown jewels:_ Invariant checks, formal verification

---

## Phase 0: Scope & Trust Model

**Objective:** Define boundaries and establish the security context before analyzing code.

### 0.1 Ingest System Context

1. Read manifests (`package.json`, `Cargo.toml`, `go.mod`, `requirements.txt`)
2. Identify tech stack and framework versions
3. Check for known CVEs in dependencies

### 0.2 Define Trust Model

Establish the security context before analyzing code. Identify and document:

- **Untrusted sources** (data entry points): API endpoints, CLI arguments, user file uploads, environment variables (if user-controlled).
- **Trusted components**: internal services with mTLS, signed configuration files.
- **Crown jewels** (what must be protected): database credentials, private keys, PII / user data, payment processing.
- **Trust boundaries** (where data crosses zones): external API → internal handler, user input → database query.

### 0.3 Map Attack Surface

- [ ] Enumerate all public API routes/endpoints
- [ ] Identify CLI entry points and argument parsing
- [ ] List external integrations (webhooks, OAuth, third-party APIs)
- [ ] Document file upload/download paths
- [ ] Note WebSocket or real-time communication channels

**Checkpoint:** Present scope and trust model. Await user approval before proceeding.

---

## Phase 1: Automated Baseline

**Objective:** Establish security baseline through breadth-first automated analysis.

### 1.1 Secret Detection

Search for high-entropy strings and credential patterns:

- `AWS_ACCESS_KEY`, `AZURE_`, `GCP_`
- `Bearer `, `Authorization:`
- Private key headers (`-----BEGIN`)
- Database connection strings
- API keys matching known formats

### 1.2 Dangerous Sink Detection

Search for risky function calls:

| Language   | Dangerous Patterns                                               |
| :--------- | :--------------------------------------------------------------- |
| Python     | `eval()`, `exec()`, `subprocess.call(shell=True)`, `os.system()` |
| JavaScript | `eval()`, `Function()`, `innerHTML`, `dangerouslySetInnerHTML`   |
| Go         | `os/exec` without validation, `template.HTML()`                  |
| Rust       | `unsafe`, `.unwrap()` in library paths, raw pointer manipulation |
| C/C++      | `strcpy`, `sprintf`, `gets`, `system()`, raw `malloc`            |
| SQL        | String concatenation in queries, missing parameterization        |

### 1.3 Configuration Audit

- [ ] Debug mode disabled (`DEBUG=False`, no dev endpoints)
- [ ] Binding addresses (no `0.0.0.0` in production)
- [ ] TLS configuration (minimum TLS 1.2, strong ciphers)
- [ ] CORS policy (no wildcard origins for sensitive APIs)
- [ ] Security headers (CSP, X-Frame-Options, HSTS)

### 1.4 Dependency Vulnerability Check

- [ ] Known CVEs in direct dependencies
- [ ] Outdated packages with security patches available
- [ ] Unmaintained dependencies (no updates in 2+ years)

**Checkpoint:** Present baseline findings. Await acknowledgment before deep review.

---

## Phase 2: Manual White-Box Review

**Objective:** Deep analysis of logic, access control, and architectural patterns that tools miss.

> **Coherence Strategy:** Analyze ONE component at a time. Present findings. Await acknowledgment before proceeding.

### 2.1 Authentication & Session Management

- [ ] Passwords hashed with modern algorithm (bcrypt, argon2, scrypt)
- [ ] No plaintext credential storage or logging
- [ ] Session tokens generated with CSPRNG
- [ ] Session invalidation on logout and password change
- [ ] MFA implementation (if applicable)
- [ ] Brute force protection (rate limiting, account lockout)

From nrdxp/predicate, MIT.

More from nrdxp/predicate