security-auditor

name	security-auditor
description	Audits repository security — hardcoded secrets, dependency vulnerabilities, environment variable management, and authentication patterns. Use when the user asks to "check security", "find secrets", "audit dependencies", or "secure my repo". Don't use for code review, deployment, or monitoring.

Security Auditor

Finds and fixes common security issues in repositories built by solo founders and small teams.

How It Works

1. Scan for hardcoded secrets and credentials
2. Check environment variable management
3. Audit dependencies for known vulnerabilities
4. Review authentication and authorization patterns
5. Check for common security misconfigurations

Step-by-Step Procedure

Step 1: Scan for Hardcoded Secrets

# Check for common secret patterns
grep -rn --include="*.ts" --include="*.tsx" --include="*.js" --include="*.jsx" --include="*.py" --include="*.env" \
  -E "(sk-[a-zA-Z0-9]{20,}|api_key\s*=\s*['\"][^'\"]+|password\s*=\s*['\"][^'\"]+|secret\s*=\s*['\"][^'\"]+|AWS_ACCESS_KEY|PRIVATE_KEY)" . \
  | grep -v node_modules | grep -v '.env.example' | head -30

If matches found: flag as critical and recommend moving to environment variables.

Step 2: Check Environment Variable Management

• .env should be in .gitignore (if not: critical)
• .env.example should exist listing all required variables
• No .env files committed to git history
• Check for process.env. or os.environ usage without defaults

Step 3: Audit Dependencies

For Node.js:

npm audit --production 2>/dev/null || echo "npm audit not available"

For Python:

pip-audit 2>/dev/null || echo "pip-audit not available"

Flag: critical and high severity vulnerabilities.

Step 4: Review Auth Patterns

• Is there authentication? (NextAuth, Clerk, Auth0, Supabase Auth, custom JWT)
• Are API routes protected? Check for middleware/guards
• Are admin routes separated from public routes?
• Is CSRF protection in place for forms?

Step 5: Check Common Misconfigurations

• CORS: Is it set to * in production? (flag as warning)
• Rate limiting: Any on API routes?
• Input validation: Are user inputs sanitized?
• HTTPS: Is the app enforcing HTTPS?

Output Format

## 🔒 Security Audit

### Critical Issues
- {issue}: {location} — {fix}

### Warnings
- {issue}: {location} — {recommendation}

### Good Practices Found
- {practice already in place}

Important

• NEVER print or expose actual secret values in output
• Always recommend .env + .env.example pattern
• Prioritize: hardcoded secrets > dependency vulns > auth gaps > misconfigs