security-audit

name	security-audit
description	Run a project-specific security audit of this Express API — auth, CSRF, rate limiting, headers, validation, secrets, and dependencies. Use when the user asks for a security review, audit, hardening pass, or before a release.

Audit the codebase against this project's security architecture. Report findings ordered by severity with file:line references; do not change code unless asked.

1. Authentication & tokens

• JWT access/refresh tokens must be delivered as signed HttpOnly cookies (src/services/auth.service.ts, cookie options in the auth controller). Flag any token exposed in a JSON body or non-HttpOnly cookie.
• Cookie flags: httpOnly: true, secure in production, sameSite set, correct maxAge matching token expiry.
• Refresh-token rotation: refresh must invalidate/replace the old token, never extend it silently.
• protect middleware (src/middleware/auth.middleware.ts) applied to every non-public route; 401 for unauthenticated, 403 for authenticated-but-forbidden.
• Ownership checks in services: a user must never read/update/delete another user's records (check every repository query filters by userId).

2. CSRF

• doubleCsrfProtection applied to all mutating routes (POST/PUT/PATCH/DELETE) in every file in src/routes/.
• Token endpoint GET /auth/csrf-token must not itself be state-changing.

3. Rate limiting & headers

• Every route group attaches a limiter from src/middleware/limiter.middleware.ts; auth routes must have the strictest limit.
• helmet and CORS configured in src/app.ts; CORS origin must come from config, never * with credentials.
• trust proxy set correctly so limiters key on the real client IP.

4. Input validation & output shaping

• Every POST/PUT/PATCH route has a Zod validation middleware from src/validations/.
• Params/query used in queries (ids, pagination) are validated, not passed raw.
• Services map entities through toResponseDTO() — flag any handler returning a raw Prisma entity (risk: leaking password, token hashes, internal fields).
• Error responses come only from src/errors/ + global error middleware; flag any res.status().json() on an error path (risk: inconsistent shape, stack leaks). Error middleware must not expose stack traces or Prisma error details in production.

5. Secrets & config

• No process.env outside src/config/env.ts; all secrets validated by the Zod env schema with no insecure defaults for JWT_SECRET/cookie secrets.
• .env gitignored; .env.example contains placeholders only. Scan the repo for hardcoded credentials, API keys, or connection strings.
• Logger (src/config/logger.ts) redacts sensitive fields (authorization headers, cookies, passwords).

6. Dependencies & platform

pnpm audit --prod

• Flag high/critical advisories with the upgrade path.
• Dockerfile: runs as non-root user, multi-stage build, no secrets baked into layers.
• CI: CodeQL/security workflows present in .github/workflows/ and passing.

Output format

For each finding: severity (critical/high/medium/low) — title — file:line — why it matters — recommended fix. End with a short summary of what was checked and found clean.