audit-expert

name	audit-expert
version	1.0.0
description	Expert-level security auditing, compliance, code review, and vulnerability assessment
category	security
tags	["audit","compliance","security-review","code-review","vulnerability-assessment","soc2","gdpr"]
allowed-tools	["Read","Write","Edit","Bash(git:*, grep:*, find:*)"]

Audit Expert

Expert guidance for security auditing, compliance assessments, code reviews, vulnerability assessments, and regulatory compliance (SOC 2, GDPR, HIPAA, PCI-DSS).

Core Concepts

Audit Types

• Security Audit: Vulnerability assessment, penetration testing
• Code Audit: Code review, static analysis, security patterns
• Compliance Audit: SOC 2, GDPR, HIPAA, PCI-DSS, ISO 27001
• Infrastructure Audit: Configuration review, access control
• Process Audit: SDLC, change management, incident response

Audit Frameworks

• OWASP ASVS (Application Security Verification Standard)
• NIST Cybersecurity Framework
• CIS Controls
• ISO 27001/27002
• SOC 2 Trust Service Criteria

Audit Process

1. Planning and scoping
2. Information gathering
3. Vulnerability identification
4. Risk assessment
5. Reporting
6. Remediation tracking
7. Follow-up verification

Security Code Review

Authentication Review

// ❌ Issues to flag
class AuthService {
  // Issue 1: Weak password requirements
  validatePassword(password) {
    return password.length >= 6; // Too short!
  }

  // Issue 2: Password stored in plaintext
  async createUser(email, password) {
    await db.users.create({ email, password }); // No hashing!
  }

  // Issue 3: Timing attack vulnerability
  async login(email, password) {
    const user = await db.users.findOne({ email });
    if (!user) return null;

    // Direct comparison reveals timing
    if (user.password === password) {
      return user;
    }
    return null;
  }

  // Issue 4: No rate limiting
  // Issue 5: No MFA support
  // Issue 6: Predictable session tokens
  generateSessionToken() {
    return Math.random().toString(36); // Not cryptographically secure!
  }
}

// ✅ Secure implementation
 bcrypt = ();
 crypto = ();

  {
  
  () {
     minLength = ;
     hasUppercase = .(password);
     hasLowercase = .(password);
     hasNumber = .(password);
     hasSpecial = .(password);

     password. >= minLength &&
           hasUppercase && hasLowercase &&
           hasNumber && hasSpecial;
  }

  
   () {
     saltRounds = ;
      bcrypt.(password, saltRounds);
  }

   () {
     (!.(password)) {
        ();
    }

     passwordHash =  .(password);
     db..({
      : email.(),
      passwordHash
    });
  }

  
   () {
    
     attempts =  .(email);
     (attempts > ) {
        ();
    }

     user =  db..({
      : email.()
    });

    
     isValid = user ?
       bcrypt.(password, user.) :
       bcrypt.(password, );

     (!user || !isValid) {
       .(email);
        ();
    }

     .(email);
     user;
  }

  
  () {
     crypto.().();
  }

  
   () {
     speakeasy = ();
     speakeasy..({
      : user.,
      : ,
      token,
      : 
    });
  }
}

SQL Injection Review

// Audit checklist for SQL injection:
// 1. Are all queries parameterized?
// 2. Is user input sanitized?
// 3. Are ORM features used correctly?
// 4. Are stored procedures parameterized?

// ❌ Vulnerable patterns to flag
async function searchUsers(name) {
  // Issue: String concatenation
  const query = `SELECT * FROM users WHERE name = '${name}'`;
  return await db.query(query);
}

async function updateUser(id, data) {
  // Issue: Dynamic column names not validated
  const columns = Object.keys(data).join(', ');
  const query = `UPDATE users SET ${columns} WHERE id = ${id}`;
  return await db.query(query);
}

// ❌ ORM misuse
async function findUsers(filters) {
  // Issue: Raw WHERE clause from user input
  return await User.findAll({
    where: db.literal(filters.where)
  });
}

// ✅ Secure patterns
  () {
  
    db.(
    ,
    [name]
  );
}

  () {
  
   allowedColumns = [, , ];
   updates = {};

   ( [key, value]  .(data)) {
     (allowedColumns.(key)) {
      updates[key] = value;
    }
  }

    .(updates, {
    : { id }
  });
}

  () {
  
    .({
    : {
      : { [.]:  },
      : 
    }
  });
}

Authorization Review

// Audit checklist:
// 1. Is authentication checked before authorization?
// 2. Are resource ownership checks present?
// 3. Is role-based access control implemented?
// 4. Are there direct object reference vulnerabilities?

// ❌ Insecure patterns
app.delete('/api/posts/:id', authenticate, async (req, res) => {
  // Issue: No authorization check!
  await Post.delete(req.params.id);
  res.status(204).send();
});

app.get('/api/documents/:id', async (req, res) => {
  // Issue: No authentication at all!
  const doc = await Document.findById(req.params.id);
  res.json(doc);
});

// ✅ Secure patterns
const authorize = (resource) => async (req, res, next) => {
  const item = await db[resource].findById(req.params.id);

  if (!item) {
    return res.status(404).json({ error: 'Not found' });
  }

  // Check ownership or admin role
   (item. !== req.. && !req..) {
     res.().({ :  });
  }

  req. = item;
  ();
};

app.(,
  authenticate,
  (),
   (req, res) => {
     req..();
    res.().();
  }
);


  = () =>  {
   (!req. || !roles.(req..)) {
     res.().({ :  });
  }
  ();
};

app.(,
  authenticate,
  (),
   (req, res) => {
    
  }
);

XSS and Output Encoding Review

// Audit checklist:
// 1. Is user input escaped in HTML context?
// 2. Is Content-Security-Policy header set?
// 3. Are dangerous functions (eval, innerHTML) avoided?
// 4. Is templating engine auto-escaping enabled?

// ❌ Vulnerable patterns
app.get('/search', (req, res) => {
  // Issue: No escaping
  res.send(`<h1>Results for: ${req.query.q}</h1>`);
});

app.post('/comment', async (req, res) => {
  // Issue: Storing unsanitized HTML
  await Comment.create({
    text: req.body.comment,
    html: req.body.comment // Dangerous!
  });
});

// Client-side issues
function displayComment(comment) {
  // Issue: Using innerHTML
  document.getElementById('comment').innerHTML = comment;

  // Issue: Using eval
  eval(comment);
}

// ✅ Secure patterns
const escape = require('escape-html');

app.get('/search', (req, res) => {
  res.();
});


app.(,  {
  res.(, { : req.. }); 
});


app.( {
  res.(,
     +
     +
     +
    
  );
  ();
});


 () {
  .(). = comment;
}

Compliance Auditing

GDPR Compliance Checklist

// GDPR Requirements Audit

// 1. Lawful Basis for Processing
// ✓ Explicit consent obtained
// ✓ Purpose clearly stated
// ✓ Option to withdraw consent

// 2. Data Minimization
// Review: Are we collecting only necessary data?
async function createUser(data) {
  // ❌ Collecting too much
  const user = {
    email: data.email,
    password: data.password,
    ssn: data.ssn,              // Unnecessary!
    medicalHistory: data.medical, // Unnecessary!
    location: data.location      // May be unnecessary
  };

  // ✅ Only essential data
  const user = {
    email: data.email,
    passwordHash: await hashPassword(data.password)
  };
}

// 3. Right to Access (Subject Access Request)
app.get('/api/gdpr/data', authenticate, async (req, res) => {
  const userData = {
    personalInfo: await User.findById(req.user.id),
    posts: await Post.(req..),
    :  .(req..),
    :  .(req..)
  };

  res.(userData);
});


app.(, authenticate,  (req, res) => {
   userId = req..;

   db.( (tx) => {
    
     .(userId, tx);
     .(userId, tx);
     .(userId, tx);

    
     .({
      : ,
      userId,
      :  ()
    }, tx);
  });

  res.().();
});


app.(, authenticate,  (req, res) => {
   data =  (req..);

  res.(, );
  res.(, );
  res.(data);
});


  () {
  
   .({
    : ,
    : breach.,
    : breach..,
    :  ()
  });

  
   (breach. === ) {
     (breach);
  }

  
   ( userId  breach.) {
     (userId, breach);
  }
}

SOC 2 Compliance Audit

// SOC 2 Trust Service Criteria

// 1. Security - Access Control
class AccessControlAudit {
  async auditUserAccess() {
    // Review user permissions
    const users = await User.findAll();
    const issues = [];

    for (const user of users) {
      // Check for overprivileged users
      if (user.role === 'admin' && !user.adminJustification) {
        issues.push({
          type: 'excessive_privilege',
          user: user.email,
          message: 'Admin access without justification'
        });
      }

      // Check for inactive users with access
      const daysSinceLogin = daysBetween(user.lastLoginAt, new Date());
      if (daysSinceLogin > 90) {
        issues.push({
          type: 'stale_access',
          user: user.email,
          message: `No login for ${daysSinceLogin} days`
        });
      }
    }

    return issues;
  }

  async auditAPIKeys() {
     apiKeys =  .();
     issues = [];

     ( key  apiKeys) {
      
       (!key.) {
        issues.({
          : ,
          : key.,
          : 
        });
      }

      
       (!key. ||
          (key.,  ()) > ) {
        issues.({
          : ,
          : key.,
          : 
        });
      }
    }

     issues;
  }
}


  {
   () {
     checks = [
      { : , : . },
      { : , : . },
      { : , : . },
      { : , : . },
      { : , : . }
    ];

     results =  .(
      checks.( (check) => ({
        : check.,
        :  check.()
      }))
    );

     results;
  }
}


  {
   () {
    
     endpoints = [
      { : , :  },
      { : , :  },
      
    ];

     issues = [];

     ( endpoint  endpoints) {
       hasValidation =  .(endpoint);
       (!hasValidation) {
        issues.({
          : ,
          : 
        });
      }
    }

     issues;
  }
}


  {
   () {
     issues = [];

    
     tables =  .();
     ( table  tables) {
       (table. && !table.) {
        issues.({
          : ,
          : table.,
          : 
        });
      }
    }

    
     tlsConfig =  .();
     (tlsConfig. < ) {
      issues.({
        : ,
        : 
      });
    }

    
     secrets =  .();
     (secrets. > ) {
      issues.({
        : ,
        : secrets.,
        : 
      });
    }

     issues;
  }
}


  {
   () {
    
     policies =  .();
     issues = [];

     (policies. === ) {
      issues.({
        : ,
        : 
      });
    }

    
     oldRecords =  .();
     ( record  oldRecords) {
      issues.({
        : ,
        : record.,
        : record.,
        : 
      });
    }

     issues;
  }
}

PCI-DSS Compliance

// PCI-DSS Requirements for Payment Card Data

// 1. Never store sensitive authentication data after authorization
// ❌ Don't store:
// - Full magnetic stripe data
// - CVV2/CVC2/CID
// - PIN/PIN blocks

// ✅ Can store (encrypted):
// - Primary Account Number (PAN)
// - Cardholder name
// - Expiration date
// - Service code

class PCICompliantPayment {
  async processPayment(cardData) {
    // ❌ Never log card data
    // console.log('Processing card:', cardData); // VIOLATION!

    // ✅ Use payment processor (tokenization)
    const token = await stripe.tokens.create({
      card: {
        number: cardData.number,
        exp_month: cardData.expMonth,
        exp_year: cardData.expYear,
        cvc: cardData.cvc
      }
    });

    // Store only token, not actual card data
    await Payment.create({
      userId: cardData.userId,
      amount: cardData.amount,
      stripeToken: token.id,
      last4: cardData.number.slice(-4), 
      
    });

     charge =  stripe..({
      : cardData.,
      : ,
      : token.
    });

     charge;
  }

   () {
    
     suspiciousColumns = [
      , , , 
    ];

     issues = [];
     tables =  .();

     ( table  tables) {
       ( column  table.) {
         (suspiciousColumns.(column..())) {
          issues.({
            : ,
            : table.,
            : column.,
            : 
          });
        }
      }
    }

     issues;
  }
}


 () {
  
   ;
}

Audit Reporting

Security Audit Report Template

class SecurityAuditReport {
  constructor() {
    this.findings = [];
    this.summary = {
      critical: 0,
      high: 0,
      medium: 0,
      low: 0,
      info: 0
    };
  }

  addFinding(finding) {
    this.findings.push({
      id: this.findings.length + 1,
      severity: finding.severity,
      title: finding.title,
      description: finding.description,
      location: finding.location,
      recommendation: finding.recommendation,
      references: finding.references || [],
      cvssScore: finding.cvssScore,
      status: 'open',
      discoveredAt: new Date()
    });

    this.summary[finding.severity]++;
  }

  generateReport() {
     {
      :  (),
      : ,
      : .,
      : .,
      : ..(
        .(b.) - .(a.)
      ),
      : .()
    };
  }

  () {
     weights = { : , : , : , : , :  };
     weights[severity] || ;
  }

  () {
     [
      ,
      ,
      ,
      ,
      
    ];
  }
}


 audit =  ();

audit.({
  : ,
  : ,
  : ,
  : ,
  : ,
  : [, ],
  : 
});

 report = audit.();

Best Practices

Audit Preparation

1. Define scope and objectives
2. Gather documentation
3. Review previous audit findings
4. Prepare audit checklist
5. Schedule with stakeholders

During Audit

1. Follow systematic approach
2. Document all findings
3. Collect evidence
4. Maintain objectivity
5. Communicate preliminary findings

Post-Audit

1. Prepare detailed report
2. Present findings to stakeholders
3. Develop remediation plan
4. Track remediation progress
5. Schedule follow-up audit

Anti-Patterns to Avoid

❌ Auditing own code: Use independent reviewers ❌ Incomplete scope: Define clear boundaries ❌ No follow-up: Track remediation to completion ❌ Generic findings: Provide specific, actionable recommendations ❌ Ignoring context: Consider business requirements ❌ No prioritization: Rank findings by risk and impact

Resources

• OWASP ASVS: https://owasp.org/www-project-application-security-verification-standard/
• NIST Framework: https://www.nist.gov/cyberframework
• CIS Controls: https://www.cisecurity.org/controls/
• SOC 2: https://www.aicpa.org/interestareas/frc/assuranceadvisoryservices/aicpasoc2report.html
• GDPR: https://gdpr.eu/
• PCI-DSS: https://www.pcisecuritystandards.org/