security-audit

name	security-audit
description	RLS validation, security audits, OWASP compliance, and vulnerability scanning. Use when validating RLS policies, auditing API routes, scanning for security issues, or reviewing code for vulnerabilities.

Security Audit Skill

Purpose

Guide security validation with RLS enforcement, OWASP compliance, and vulnerability detection following security-first architecture.

When This Skill Applies

• Validating RLS policies
• Auditing API routes for auth
• Vulnerability scanning
• Pre-deployment security review
• Checking for exposed credentials
• Reviewing database access patterns

Stop-the-Line Conditions

FORBIDDEN Patterns

// FORBIDDEN: Direct Prisma calls (bypass RLS)
const users = await prisma.user.findMany();
// Must use: withUserContext, withAdminContext, or withSystemContext

// FORBIDDEN: Missing authentication on protected routes
export async function GET(req: Request) {
  // No auth check before accessing user data
  return getUserData();
}

// FORBIDDEN: Exposed credentials
const API_KEY = "sk_live_abc123"; // Hardcoded secret

// FORBIDDEN: SQL injection vulnerability
const query = `SELECT * FROM users WHERE id = ${userId}`; // Interpolated

CORRECT Patterns

// CORRECT: RLS context wrapper
const users = await withUserContext(prisma, userId, async (client) => {
  return client.user.findMany();
});

// CORRECT: Auth check before data access
export async function GET(req: Request) {
  const { userId } = await auth();
  if (!userId) {
    return new Response("Unauthorized", { status: 401 });
  }
  return getUserData(userId);
}

// CORRECT: Environment variables for secrets
const API_KEY = process.env.STRIPE_SECRET_KEY;

// CORRECT: Parameterized queries
const user = await prisma.$queryRaw`SELECT * FROM users WHERE id = ${userId}`;

Security Audit Checklist

1. RLS Validation

• All database operations use context wrappers
• No direct Prisma calls in route handlers
• User isolation verified (user A cannot see user B's data)
• Admin operations properly scoped

# Find potential RLS bypasses
grep -r "prisma\." --include="*.ts" app/ lib/ | grep -v "withUserContext\|withAdminContext\|withSystemContext"

2. Authentication Checks

• All protected routes verify authentication
• Auth provider auth() called before data access
• Proper 401/403 responses for unauthorized

# Find routes missing auth checks
grep -r "export async function" --include="route.ts" app/ | head -20
# Manually verify each has auth check

3. Credential Scanning

• No hardcoded secrets in code
• No API keys in client-side code
• Environment variables used correctly

# Scan for potential secrets
grep -rE "(sk_live|pk_live|password|secret|key)" --include="*.ts" --include="*.tsx" | grep -v "process.env\|.env"

4. Dependency Vulnerabilities

# Run security audit
npm audit
yarn audit

# Check for high/critical vulnerabilities
npm audit --audit-level=high

5. Input Validation

• User input validated with Zod schemas
• No raw query interpolation
• File upload restrictions in place

OWASP Top 10 Checklist

Risk	Check	Status
A01 Broken Access	RLS enforced, auth on all routes	☐
A02 Crypto Failures	Secrets in env vars only	☐
A03 Injection	Parameterized queries, Zod	☐
A04 Insecure Design	Auth-first pattern followed	☐
A05 Misconfiguration	Prod env properly secured	☐
A06 Vulnerable Deps	npm audit clean	☐
A07 Auth Failures	Auth integration correct	☐
A08 Data Integrity	RLS prevents tampering	☐
A09 Logging Failures	Security events logged	☐
A10 SSRF	External URLs validated	☐

Security Validation Commands

# Complete security check
npm audit && yarn lint && echo "Security checks passed"

# RLS bypass detection
grep -r "prisma\." --include="*.ts" app/ lib/ | wc -l
# Compare with context wrapper count

# Secret detection
git secrets --scan  # If git-secrets installed
grep -rE "sk_|pk_|password=" . --include="*.ts"

Pre-Deployment Security Review

Before ANY production deployment:

• npm audit shows no high/critical issues
• RLS policies validated
• No new direct Prisma calls
• Environment variables documented
• Backup taken before migration
• Rollback plan documented

Security Audit Report Template

## Security Audit Report - {{TICKET_PREFIX}}-XXX

### Summary

- **Date**: [date]
- **Auditor**: Security Engineer
- **Scope**: [what was audited]

### Findings

| Severity | Issue | Location | Status |
| -------- | ----- | -------- | ------ |
| HIGH     | ...   | ...      | FIXED  |
| MEDIUM   | ...   | ...      | OPEN   |

### RLS Validation

- [x] All tables have RLS enabled
- [x] User isolation verified
- [x] Admin policies scoped correctly

### Recommendations

1. [recommendation]
2. [recommendation]

### Approval

- [ ] Security Engineer approves
- [ ] Ready for deployment

Reference

• Security Architecture: docs/guides/SECURITY_FIRST_ARCHITECTURE.md
• RLS Implementation: docs/database/RLS_IMPLEMENTATION_GUIDE.md
• RLS Policies: docs/database/RLS_POLICY_CATALOG.md
• OWASP Top 10: https://owasp.org/Top10/