security-scan

name	security-scan
description	Rapid security scanning workflow for code changes. Activates a focused security sweep. Activate when: security scan, scan for vulnerabilities, check for secrets, security check, run security audit, check deps.
argument-hint	[path or scope to scan — defaults to recent git changes]

Security Scan

Rapid security sweep for code changes. Faster than a full /review — focused on security only.

When to Use

• Before committing code that touches auth, user input, data storage, or external APIs
• After adding new dependencies
• Quick pre-PR security gate

Scan Protocol

Step 1: Determine Scope

# Default: scan recent changes
git diff --name-only HEAD~1

# Or use provided path

Step 2: Secrets Scan

# Scan for common secret patterns
grep -rn --include="*.{ts,js,py,go,rs,java,cs,yaml,json,env,sh,toml}" \
  -e "sk-[A-Za-z0-9]\{32,\}" \
  -e "ghp_[A-Za-z0-9]\{36\}" \
  -e "AKIA[0-9A-Z]\{16\}" \
  -e "api.key\s*=\s*['\"][^'\"]\{8,\}" \
  -e "password\s*=\s*['\"][^'\"]\{4,\}" \
  -e "secret\s*=\s*['\"][^'\"]\{8,\}" \
  .

# Check .env is in .gitignore
cat .gitignore | grep -E "\.env$|\.env\."

CRITICAL: Any match in committed code = immediate blocker.

Step 3: Dependency Audit

Run language-appropriate audit:

# Node.js
npm audit --audit-level=high

# Python
pip-audit  # or: safety check

# Rust
cargo audit

# Go
govulncheck ./...

# Java/Maven
mvn dependency-check:check

Report: Count of critical/high severity CVEs and their package names.

Step 4: Input Validation Spot-Check

For changed files that handle user input (API endpoints, form handlers, CLI args):

• Is input validated/sanitized before use?
• Are SQL queries parameterized (no string concatenation)?
• Is HTML output escaped before rendering?
• Are file paths sanitized (no ../ traversal)?

Step 5: Auth/Authz Quick Check

For changed files touching auth:

• Is authentication checked BEFORE authorization?
• Are authorization checks on EVERY relevant endpoint?
• Are JWT tokens validated (algorithm + signature + expiry)?
• Are session cookies HttpOnly; Secure; SameSite=Strict?

---

Output Format

## Security Scan Report

**Scope:** [files scanned]
**Date:** [timestamp]

### Secrets
- [ ] No hardcoded secrets found
- ⚠ Found: [file:line — description]

### Dependencies
- Critical CVEs: X
- High CVEs: Y
- Packages: [list if any]

### Input Validation
- [ ] User inputs sanitized in changed files
- ⚠ Risk: [file:line — description]

### Auth
- [ ] Auth/authz checks present on relevant routes
- ⚠ Risk: [file:line — description]

### Verdict
CLEAN / NEEDS ATTENTION / BLOCKER

### Next Steps
- [Action items with file:line references]

Severity Quick Reference

Finding	Severity	Action
Hardcoded secret in committed file	CRITICAL	Rotate key + remove from history
Critical CVE in direct dependency	HIGH	Update package immediately
SQL injection risk	CRITICAL	Parameterize query before PR
Missing auth check on endpoint	HIGH	Add before PR
High CVE in transitive dependency	MEDIUM	Track in backlog
HTTP instead of HTTPS	MEDIUM	Enforce HTTPS redirect

See Also

• @security-reviewer — comprehensive OWASP Top 10 security review
• /review — full code review including security
• /coding-standards — baseline code quality rules