security-audit

name	security-audit
type	workflow
description	Comprehensive security auditing workflow covering web application testing, API security, penetration testing, vulnerability scanning, and security hardening.
context	fork
agent	security-engineer
when_to_use	When performing security audits, vulnerability scanning, penetration testing, or hardening web applications and APIs
allowed-tools	Read, Glob, Grep, Bash
argument-hint	[target: api|frontend|backend|infra|full]
user-invocable	true
effort	5

Security Auditing Workflow

Systematic security review using static analysis tools available in the codebase. Covers OWASP Top 10, secrets exposure, auth patterns, and dependency risk.

Phase 1: Reconnaissance — Map the Attack Surface

1. Identify entry points — list all routes/controllers:

   grep -rn "app\.\(get\|post\|put\|delete\|patch\)\|@app\.route\|router\." src/ --include="*.{js,ts,py}" | head -60
   

2. Identify auth middleware — check which routes are protected:

   grep -rn "auth\|middleware\|guard\|require_login\|jwt\|bearer" src/ -i --include="*.{js,ts,py}" | head -40
   

3. Map external dependencies — check package files for known-risky libs:

   cat package.json 2>/dev/null || cat requirements.txt 2>/dev/null || cat go.mod 2>/dev/null
   

4. Note findings — list: total endpoints found, unprotected routes, third-party auth libs.

---

Phase 2: Secrets & Sensitive Data Exposure

1. Scan for hardcoded secrets:

   grep -rn "password\s*=\s*['\"][^'\"]\|api_key\s*=\s*['\"][^'\"]\|secret\s*=\s*['\"][^'\"]" src/ -i | grep -v ".example" | head -30
   

2. Scan for tokens/keys in source:

   grep -rEn "(sk-|AIza|AKIA|ghp_|xox[baprs]-)[A-Za-z0-9]+" src/ | head -20
   

3. Check .env files are gitignored:

   cat .gitignore | grep -i "\.env" ; ls -la .env* 2>/dev/null
   

4. Check for secrets in logs: