security-review

name	security-review
description	Comprehensive security audit for authentication, input validation, secrets, and API security. Use for pre-deployment audits or targeted security analysis.
effort	high
allowed-tools	Bash, Read, Grep, Glob

Security Review

Perform a comprehensive security audit of code changes or specified files.

Instructions

1. Determine Scope

If $ARGUMENTS provided, review those specific files/directories. Otherwise, review recent changes with git diff (or git diff HEAD~1 if no uncommitted changes).

2. Load Security Rules

Read .claude/context/security/security-rules.md for the complete security checklist.

3. Run Automated Scans

# Dependency vulnerabilities
pnpm -r audit

Use Grep to search for secret patterns listed in security-rules.md section 1.

Search for vulnerability patterns:

Pattern	What It Finds	Files to Check
.raw( without ?	SQL injection	*.repository.ts, *Query.ts
whereRaw( without bindings	SQL injection	Same
dangerouslySetInnerHTML	XSS	*.tsx
eval(	Code injection	*.ts, *.js
child_process.exec with variables	Command injection	*.ts
console.log with sensitive context	Data exposure	Auth-related files
Missing @UseGuards	Auth bypass	*.controller.ts

4. Apply Security Rules

Apply all 11 rule sections from security-rules.md to the scoped code:

1. Secrets Management (CRITICAL)
2. Input Validation (CRITICAL)
3. SQL Injection Prevention (CRITICAL)
4. Authentication & Authorization (CRITICAL)
5. XSS Prevention (HIGH)
6. CSRF Protection (HIGH)
7. Rate Limiting (HIGH)
8. Sensitive Data Exposure (HIGH)
9. Dependency Security (HIGH)
10. API Security (HIGH)
11. Database Security (HIGH)

Then evaluate against the OWASP Top 10 checklist and Benefriches-specific checks.

5. Report Format

For each finding:

### [SEVERITY] Finding Title

**File:** path/to/file.ts:line
**Category:** OWASP A0X - Category Name
**Description:** What the vulnerability is
**Impact:** What could happen if exploited
**Remediation:** How to fix it

// Vulnerable code
<code snippet>

// Fixed code
<code snippet>

Severity Levels:

• CRITICAL: Exploitable vulnerabilities, data exposure, auth bypass
• HIGH: Security weaknesses requiring immediate attention
• MEDIUM: Defense-in-depth improvements
• LOW: Best practice recommendations

6. Summary

End with:

## Security Review Summary

### Scan Results
- Dependency Audit: X vulnerabilities (X critical, X high, X moderate)
- Secret Scan: X potential secrets found
- Pattern Scan: X suspicious patterns

### Findings by Severity
- Critical: X
- High: X
- Medium: X
- Low: X

### Verdict

✅ **PASS** - No critical or high severity issues
⚠️ **REVIEW NEEDED** - Medium issues require attention before production
❌ **BLOCK** - Critical/high issues must be fixed before deployment

---

Pre-Deployment Checklist

Before deploying to production, verify:

• pnpm -r audit shows no critical/high vulnerabilities
• No hardcoded secrets in codebase
• All API endpoints have appropriate authentication
• All user input is validated with Zod schemas
• Database queries use parameterized queries only
• Error messages don't expose internal details
• Security headers are configured
• Rate limiting is enabled
• Logging doesn't include sensitive data
• File uploads are validated and sanitized

---

Scope

$ARGUMENTS

If no scope provided, review all uncommitted changes.