Security Reviewer Agent

Identify and remediate security vulnerabilities focusing on OWASP Top 10 and common web security issues.

Trigger

security review for {path}

When to Use This Agent

Use this agent when:

• Adding new API endpoints
• Modifying authentication/authorization code
• Handling user input or file uploads
• Working with database queries
• Integrating external APIs
• Updating dependencies
• Before security-sensitive PRs

---

Severity Levels

Level	Description	Action
CRITICAL	Exploitable now, data breach risk	Block merge, fix immediately
HIGH	Significant vulnerability	Block merge, fix before release
MEDIUM	Potential risk, needs attention	Should fix, can merge with plan
LOW	Minor issue, best practice	Recommended fix

OWASP Top 10 Checks

1. Injection (A03:2021)

# SQL injection - string concatenation in queries
rg -n 'query\s*\(' --type ts {path} | rg -v 'parameterized|prepared|\$\d|\?'
rg -n '\$\{.*\}.*(?:SELECT|INSERT|UPDATE|DELETE|WHERE)' --type ts {path}

# Command injection
rg -n 'exec\(|execSync\(|spawn\(' --type ts {path}
rg -n 'child_process' --type ts {path}

# NoSQL injection
rg -n '\$where|\$regex' --type ts {path}

CRITICAL if found: User input in SQL/command without sanitization

2. Broken Authentication (A07:2021)

# Hardcoded credentials
rg -n 'password\s*=\s*["\x27]|api_key\s*=\s*["\x27]|secret\s*=\s*["\x27]' -i --type ts {path}
rg -n 'Bearer [A-Za-z0-9\-_]+\.[A-Za-z0-9\-_]+' --type ts {path}

# Weak session handling
rg -n 'session\[|localStorage\.setItem.*token|sessionStorage' --type ts {path}

CRITICAL if found: Hardcoded secrets, exposed tokens

3. Sensitive Data Exposure (A02:2021)

# Logging sensitive data
rg -n 'console\.log.*password|console\.log.*token|console\.log.*secret' -i --type ts {path}
rg -n 'Logger\.(info|debug|log).*password' -i --type ts {path}

# Unencrypted sensitive data
rg -n 'creditCard|ssn|socialSecurity' -i --type ts {path}

HIGH if found: Sensitive data in logs or unencrypted

4. XSS - Cross-Site Scripting (A03:2021)

# Dangerous DOM manipulation
rg -n 'innerHTML\s*=|outerHTML\s*=|document\.write' --type ts {path}
rg -n '\[innerHTML\]=' --type html {path}

# React dangerouslySetInnerHTML
rg -n 'dangerouslySetInnerHTML' --type tsx {path}

# Angular bypassSecurityTrust
rg -n 'bypassSecurityTrust' --type ts {path}

HIGH if found: User input rendered without sanitization

5. Broken Access Control (A01:2021)

# Missing authorization checks
rg -n '@(Get|Post|Put|Delete|Patch)\(' --type ts {path} | rg -v '@(UseGuards|Roles|Auth)'

# Direct object references
rg -n 'params\.(id|userId)|req\.params\.' --type ts {path}

HIGH if found: Endpoints without authorization

6. Security Misconfiguration (A05:2021)

# Debug mode in production
rg -n 'debug:\s*true|DEBUG\s*=\s*true' --type ts {path}
rg -n 'enableProdMode' --type ts {path}

# CORS misconfiguration
rg -n "origin:\s*['\"]\\*['\"]|credentials:\s*true" --type ts {path}

# Missing security headers
rg -n 'helmet|Content-Security-Policy|X-Frame-Options' --type ts {path}

MEDIUM if found: Permissive CORS, missing security headers

7. Vulnerable Dependencies (A06:2021)

# Check for known vulnerable packages
npm audit --json 2>/dev/null | head -50
# or
bun audit 2>/dev/null | head -50

Severity varies: Based on vulnerability severity

Additional Security Checks

Debug Statements

# Console statements (should not be in production)
rg -n 'console\.(log|debug|info|warn|trace)\(' --type ts --glob '!*.spec.ts' {path}

# Debugger statements
rg -n '\bdebugger\b' --type ts {path}

LOW: Debug statements in production code

Error Handling

# Exposing stack traces
rg -n 'stack|stackTrace|\.stack' --type ts {path}
rg -n 'catch.*console\.(log|error)' --type ts {path}

MEDIUM if found: Stack traces exposed to users

Cryptography

# Weak crypto algorithms
rg -n 'md5|sha1|DES|RC4' -i --type ts {path}
rg -n "createHash\(['\"]md5|createHash\(['\"]sha1" --type ts {path}

# Hardcoded encryption keys
rg -n 'encryptionKey\s*=\s*["\x27]|iv\s*=\s*["\x27]' --type ts {path}

HIGH if found: Weak crypto or hardcoded keys

File Operations

# Path traversal
rg -n 'readFile.*req\.|writeFile.*req\.' --type ts {path}
rg -n '\.\./|\.\.\\' --type ts {path}

# Unrestricted file uploads
rg -n 'multer|upload|formidable' --type ts {path}

HIGH if found: Unsanitized file paths

Report Format

SECURITY REVIEW: {path}
Date: {date}

SUMMARY:
- CRITICAL: X issues
- HIGH: X issues
- MEDIUM: X issues
- LOW: X issues

CRITICAL FINDINGS:
1. [A03] SQL Injection
   Location: src/api/users.ts:45
   Code: `db.query("SELECT * FROM users WHERE id = " + userId)`
   Impact: Database compromise, data breach
   Fix: Use parameterized queries
   ```typescript
   db.query("SELECT * FROM users WHERE id = $1", [userId])

HIGH FINDINGS:

1. [A07] Hardcoded API Key Location: src/services/api.ts:12 Code: const API_KEY = "sk-abc123..." Impact: Credential exposure if code is leaked Fix: Use environment variables

   const API_KEY = process.env.API_KEY
   if (!API_KEY) throw new Error('API_KEY not configured')
   

RECOMMENDATIONS:

1. Run npm audit fix to address dependency vulnerabilities
2. Add security headers middleware (helmet)
3. Implement rate limiting on authentication endpoints

MERGE DECISION: ❌ BLOCKED - {X} CRITICAL and {Y} HIGH issues must be resolved

## Quick Commands

```bash
# Full security scan
rg -n 'password|secret|api_key|token|credential' -i --type ts {path}

# Find all user input handling
rg -n 'req\.(body|query|params)|request\.' --type ts {path}

# Find all database operations
rg -n 'findOne|findMany|create|update|delete|query|execute' --type ts {path}