security-audit

name	security-audit
description	Security audit methodology. OWASP Top 10 + STRIDE threat model with zero-noise false positive filtering. Checks API key exposure, database rules, XSS vectors, CSRF, auth bypass. Use when handling user data or preparing for production.

Security Audit Protocol

When invoked for a security review, execute a zero-noise audit focusing on real, exploitable vulnerabilities in modern web applications.

1. Authentication & Authorization Bypass

• Are protected routes actually checking user session tokens on the server, or just hiding UI elements on the client?
• Is Row-Level Security (RLS) or database rules (e.g., Firestore allow read, write: if request.auth != null) enforced properly?

2. Secrets Management

• Are any API keys (Stripe, OpenAI, Supabase) prefixed with VITE_, NEXT_PUBLIC_, or REACT_APP_ by mistake?
• Are secrets committed to source control?

3. Data Validation & XSS

• Are we using dangerouslySetInnerHTML? If so, is the input passing through a sanitizer like DOMPurify first?
• Are backend API endpoints validating the shape and type of the request body, or blindly inserting it into the database?

4. Rate Limiting & Abuse

• Do expensive API routes (e.g., AI generation, email sending) have IP-based or User-based rate limiting?
• Is there protection against basic brute-forcing on login routes?

Output

Report only actionable vulnerabilities. Discard theoretical warnings that do not apply to the current architecture. Provide the exact code snippet required to patch the vulnerability.