security-checklist

name	security-checklist
description	Verify security vulnerabilities — hardcoded secrets, SQL injection, JWT validation, blacklist enforcement, sensitive logging, and authorization checks. Run before merging any auth or API-related changes.
allowed-tools	Bash(git *:*), Bash(grep *:*), Read, Glob, Grep

Step 1 — Gather Changed Files

git diff develop...HEAD --name-only 2>/dev/null || git diff HEAD~5...HEAD --name-only

Read each changed .java file with the Read tool for detailed analysis.

---

Step 2 — Run Checklist

1. Hardcoded Secrets

• No API key, password, or secret value hardcoded in .java files?
• No secrets in application.yml — using ${ENV_VAR} placeholders?
• No base64-encoded secret strings embedded in code?

Search commands:

grep -rn "password\s*=\s*\"" src/main/java --include="*.java"
grep -rn "secret\s*=\s*\"" src/main/java --include="*.java"
grep -rn "apiKey\s*=\s*\"" src/main/java --include="*.java"
grep -rE "['\"]([A-Za-z0-9+/]{40,}={0,2})['\"]" src/main/java --include="*.java"

2. SQL Injection

• All queries use JPA, QueryDSL, or @Query with named parameters — no string concatenation?
• No native queries built with user input directly?

3. JWT Validation (see JwtProvider, JwtFilter)

• Token signature validated via jwtProvider.validateAccessToken()?
• Expiration checked before processing claims?
• Access token checked against Redis blacklist before granting access?

4. Blacklist & Refresh Token Enforcement

• On logout: access token stored in Redis blacklist via redisUtil.setBlackList() with TTL equal to remaining expiry?
• On logout: refresh token deleted from RefreshTokenRepository by phone number?
• JwtFilter checks blacklist before populating SecurityContextHolder?

5. Sensitive Data in Logs

• No password, token, or phone number logged at any level?
• No personal information (name, phone number) in debug/error logs?
• Log level appropriate — no excessive log.debug left in production paths?

6. Authorization

• All protected endpoints require authentication via SecurityConfig?
• Resource ownership verified — users can only access their own data?
• Admin-only endpoints restricted by Role check or @PreAuthorize?
• WebSocket/chat endpoints properly secured?

7. Input Validation

• All request DTOs use @Valid in controller method parameters?
• Constraints (@NotBlank, @NotNull, etc.) applied on record fields?
• No user-controlled values passed directly to file paths or external commands?

8. External API Keys (nurigo SMS, AWS S3, FCM)

• API keys loaded from properties/environment — not hardcoded?
• API keys not returned in any response DTO?
• API key values not printed in logs?

---

Step 3 — Report

Output each item as:

• ✓ Pass
• ⚠ Warning (recommendation)
• ✗ Error (must fix)

Group by category, then summarize:

Total {n} items checked
✓ {p} passed / ⚠ {w} warnings / ✗ {e} errors

Issues found:
- ✗ [file] : [problem description]
- ⚠ [file] : [recommendation]