| name | Security Audit |
| description | Adversarial security probing and vulnerability assessments across Node, Go, Dart, Java, Python, and Rust. |
| metadata | {"labels":["security","audit","pentest","vulnerability","cve","secrets","injection"],"triggers":{"files":["package.json","go.mod","pubspec.yaml","pom.xml","Dockerfile"],"keywords":["security audit","vulnerability scan","secrets detection","injection probe","pentest"]}} |
Security Audit
Priority: P0 (CRITICAL)
📋 Security Probing Protocol
1. Hardcoded Secrets (Critical)
Scan for plain-text keys, passwords, and tokens in code.
grep -riE "(password|apiKey|api_key|secret|private_key|token)\s*=\s*['\"][^'\"]{6,}" \
. --exclude-dir={node_modules,dist,build,.git} -l
2. Data Leakage in Logs (PII/Secrets)
Identify sensitive info printed to logs or stdout.
- Node/TS:
grep -rE "console\.(log|error|warn)" . --include="*.ts" --include="*.js" | grep -iE "password|token|secret|private"
- Go:
grep -rE "log\.(Print|Printf|Println|Fatal)" . --include="*.go" | grep -iE "password|token|secret"
- Dart/Flutter:
grep -rE "print\(|debugPrint\(" . --include="*.dart" | grep -iE "password|token|secret"
- Java/Spring:
grep -rE "log(ger)?\.(info|debug|warn|error)" . --include="*.java" | grep -iE "password|token|secret"
3. Injection Surface (SQL / Command)
Detect raw string concatenation in queries or system commands.
