security-audit

name	security-audit
description	Perform a security pass aligned with MediaJira standards (no secrets, auth/CORS, input validation, least privilege, credential handling). Use for pre-release checks or when touching auth/sensitive code.

Security Audit

When to Use

• User asks for a security review, security audit, or security pass.
• User mentions auth, credentials, CORS, or sensitive data handling.
• Task involves pre-release checks or changes to authentication or authorization.

Context

• Follow .cursor/AGENTS.md (Security section and Error handling conventions) and .cursor/rules.md (security and privacy).
• Use any user-provided context (module or path) to focus the audit scope.

Instructions

1. Secrets and logging: Confirm no .env, tokens, keys, or credentials are committed or logged. Search for accidental exposure of auth headers or sensitive data in logs.
2. Dependencies: Check for known vulnerabilities in backend and frontend dependencies. Update outdated or vulnerable packages.
3. Backend: Validate that all client input is validated and sanitized; treat client data as untrusted. Ensure permissions are enforced (auth and authorization early); default to deny. Use DRF ValidationError/PermissionDenied; do not expose stack traces or internals. Review CORS: allowed origins allowlisted in backend/backend/settings.py; no wildcards for production.
4. Frontend: Confirm credentials: only token (and minimal user/org context) stored; no passwords. Token sent only via the axios interceptor (Authorization: Bearer); components do not read or send tokens directly. API layer does not swallow errors; 401 handled by interceptor (clear storage, redirect to login).
5. Infrastructure: Review environment variables and access controls. Ensure production uses HTTPS for all traffic.

Security Checklist

• No secrets in git or logs.
• Input validation on backend; least privilege for permissions.
• Auth: token-based; Bearer header; 401 triggers logout/redirect.
• CORS: allowlisted origins only; credentials configured correctly.
• Frontend: token storage and transmission per AGENTS.md; no password storage.
• Dependencies audited; no known high/critical vulnerabilities.