security-audit

name	security-audit
description	Deep security audit of the codebase (Janet Moore's workflow)

Perform a security audit following Janet Moore's standards.

Audit Checklist

1. Authentication & Authorization

• Read the dependencies/DI file — verify timing-safe comparison (see stack concepts) is used, not equality operator
• Verify health/readiness endpoints bypass auth via the public DI dependency
• Verify ALL state-changing endpoints require auth when API key is configured
• Check error messages are uniform — no enumeration clues

2. Input Validation

• Read the models/schemas file — verify all fields have type constraints
• Check identifier parameters use appropriate validation constraints
• Check state parameters use enum types — no raw strings
• Verify typed schemas (see stack concepts) are used on every endpoint (no raw object parsing)

3. Information Leakage

• Search for traceback, stack, __file__, __name__ in API responses
• Verify all error responses use the error response model
• Check no internal paths, class names, or implementation details in 4xx/5xx responses
• Verify logging never outputs API keys or secrets

4. Audit Trail

• Verify ALL state-changing operations produce audit log entries
• Check audit entries include: action, identifier, state, timestamp
• Verify all state-changing service methods produce audit entries

5. Rate Limiting

• Read the middleware file — verify per-client IP rate limiting
• Check 429 response includes Retry-After header
• Verify rate limit is configurable via the project's env vars

6. CORS & Headers

• Check CORS origins come from config, not hardcoded
• Verify CORS is configurable via the project's env vars

7. Dependencies

• Run dependency audit command if available to check for known CVEs
• Review the requirements file for outdated or vulnerable packages

Output Format

Group findings by severity: Critical, High, Medium, Low, Info Include specific file:line references and remediation steps for each finding.