// ❌ WRONG - Hardcoded API key
const API_KEY = "sk_live_1234567890abcdef";
const password = "mypassword123";

// ✅ CORRECT - Use environment variables
const API_KEY = import.meta.env.VITE_API_KEY;
const password = process.env.PASSWORD; // Server-side only

Fix:

Move secrets to .env file
Use import.meta.env.VITE_* for client-safe values
Never commit .env to version control

Check: check_hardcoded_secrets.mjs

2. eval() Usage Check

Rule: Never use eval() - it's a major security risk.

Security risks:

Code injection vulnerabilities
XSS (Cross-Site Scripting) attacks
Arbitrary code execution
Performance issues

Violations:

// ❌ WRONG - eval() is dangerous
const result = eval(userInput);
eval("alert('XSS')");

// ✅ CORRECT - Use safe alternatives
const result = JSON.parse(jsonString);
const func = new Function('return ' + code)(); // Still risky, use carefully

Fix:

Replace with JSON.parse() for JSON data
Use direct function calls
Use template literals
If dynamic code is required, use sandboxed environment

Check: check_eval_usage.mjs

3. Dangerous HTML Patterns Check

Rule: Avoid dangerouslySetInnerHTML and innerHTML - they can cause XSS attacks.

Security risks:

XSS (Cross-Site Scripting) vulnerabilities
Malicious script injection
DOM-based attacks

Violations:

// ❌ WRONG - Direct HTML injection
element.innerHTML = userContent;
<div dangerouslySetInnerHTML={{ __html: userInput }} />

// ✅ CORRECT - Use React rendering
<div>{content}</div>

// ✅ ACCEPTABLE - Sanitized HTML
import DOMPurify from 'dompurify';
const clean = DOMPurify.sanitize(dirtyHTML);
<div dangerouslySetInnerHTML={{ __html: clean }} />

Fix:

Use React's built-in rendering (safest)
If HTML rendering required, sanitize with DOMPurify first
Never trust user input

Check: check_dangerous_html.mjs

4. Environment Variable Exposure Check

Rule: Only expose environment variables prefixed with VITE_ to client code.

Safe variables:

import.meta.env.VITE_* - Explicitly safe for client
import.meta.env.MODE - Vite built-in
import.meta.env.DEV - Vite built-in
import.meta.env.PROD - Vite built-in

Violations:

// ❌ WRONG - Exposing non-VITE_ variable to client
const secret = import.meta.env.API_SECRET;
const key = import.meta.env.DATABASE_URL;

// ✅ CORRECT - Use VITE_ prefix for client-safe values
const apiUrl = import.meta.env.VITE_API_URL;
const appName = import.meta.env.VITE_APP_NAME;

Fix:

Rename variables to start with VITE_ prefix (if safe to expose)
If variable contains secrets, keep it server-side only
Use server-side API endpoints for sensitive operations

Check: check_env_exposure.mjs

Running Checks

Run All Checks

node ./.claude/skills/security-audit/scripts/run_all_checks.mjs

Run Individual Checks

# Hardcoded secrets check
node ./.claude/skills/security-audit/scripts/check_hardcoded_secrets.mjs

# eval() usage check
node ./.claude/skills/security-audit/scripts/check_eval_usage.mjs

# Dangerous HTML patterns check
node ./.claude/skills/security-audit/scripts/check_dangerous_html.mjs

# Environment variable exposure check
node ./.claude/skills/security-audit/scripts/check_env_exposure.mjs

Generating Reports (Optional)

To save a comprehensive markdown report of all checks:

node ./.claude/skills/security-audit/scripts/generate_report.mjs

Output: reports/{YYYY-MM-DD_HH-MM}/security-audit-report.md

Report includes:

Executive summary with pass/fail counts
Results table for all checks
Detailed violations for failed checks (collapsible)
Summary of passed checks
Security principles verified
Prioritized recommendations

Environment variable:

# Custom report directory
export REPORT_DIR="reports/my-custom-timestamp"
node ./.claude/skills/security-audit/scripts/generate_report.mjs

Usage patterns:

# Option 1: Console output only (default)
node ./.claude/skills/security-audit/scripts/run_all_checks.mjs

# Option 2: Console output + Save report
node ./.claude/skills/security-audit/scripts/generate_report.mjs

# Option 3: Specific check only
node ./.claude/skills/security-audit/scripts/check_hardcoded_secrets.mjs

Report structure:

reports/
└── 2025-11-01_14-30/               # Includes hours and minutes for multiple runs per day
    ├── security-audit-report.md    # This skill's report
    ├── code-audit-report.md        # Code quality audit (separate)
    ├── arch-audit-report.md        # Architecture audit (separate)
    └── ...                         # Other reports

Output Format

Each check produces:

Clear violation report with file paths and line numbers
Code snippets showing the issue
Explanation of security risks
Suggested fixes with examples
Summary with violation count
Exit code 0 (success) or 1 (failures)

Example output:

Hardcoded Secrets Check
================================================================================

Rule: Never hardcode secrets (API keys, passwords, tokens) in source code

Violations
--------------------------------------------------------------------------------

❌ Found 2 hardcoded secret(s)

  API_KEY (1 occurrence(s)):
    File: src/services/api.ts:15
    Snippet: const API_KEY = "sk_live_1234567890abcdef";

  PASSWORD (1 occurrence(s)):
    File: src/config/database.ts:8
    Snippet: password: "mypassword123"

Fix:
  1. Move secrets to environment variables
  2. Use .env file for local development (never commit .env!)
  3. Use process.env.API_KEY or import.meta.env.VITE_API_KEY

================================================================================
Summary: 2 violation(s)

Security Benefits

Defense in Depth

Multiple layers of security checks
Catches common vulnerabilities early
Prevents security issues before production

OWASP Top 10 Coverage

A03: Injection - Detects eval() and SQL injection risks
A07: XSS - Detects dangerous HTML patterns
A05: Security Misconfiguration - Detects exposed secrets

Secure Development

Enforces security best practices
Educates team on security risks
Catches vulnerabilities in CI/CD pipeline

Compliance

Helps meet security audit requirements
Provides evidence of security practices
Tracks security improvements over time

Tools

Bash: Run Node.js check scripts
Read: Read source files (if manual inspection needed)
Write: reports/{timestamp}/security-audit-report.md (only when generating reports)

Safety

Read-only operations (unless generating reports)
No source file modifications
No external network calls
Comprehensive vulnerability analysis
Each check is isolated and focused
Reports are saved to isolated reports/ directory