Security audit for vulnerabilities, dependencies, and best practices
Performs comprehensive security audit checking dependencies, secrets, OWASP vulnerabilities, and code patterns.
/plugin marketplace add Benny9193/devflow/plugin install benny9193-devflow@Benny9193/devflowPerform a comprehensive security review of the codebase.
Check for known vulnerabilities in dependencies:
# Node.js
npm audit
npx better-npm-audit audit
# Python
pip-audit
safety check
# Ruby
bundle audit check --update
# Go
govulncheck ./...
# Rust
cargo audit
Scan for accidentally committed secrets:
Patterns to detect:
[A-Za-z0-9_]{20,}AKIA[0-9A-Z]{16}-----BEGIN (RSA|EC|OPENSSH) PRIVATE KEY-----ghp_, gho_, github_pat_, sk-, Bearer password\s*[:=]\s*["']?[^"'\s]+mongodb://, postgres://, mysql://Files to check:
.env* files.json, .yaml, .toml)git log -p | grep -E "password|secret|key")// BAD
const query = `SELECT * FROM users WHERE id = ${userId}`;
// GOOD
const query = `SELECT * FROM users WHERE id = $1`;
await db.query(query, [userId]);
// BAD
element.innerHTML = userInput;
// GOOD
element.textContent = userInput;
// or use DOMPurify
element.innerHTML = DOMPurify.sanitize(userInput);
// BAD
const file = path.join(baseDir, userInput);
// GOOD
const file = path.join(baseDir, path.basename(userInput));
if (!file.startsWith(baseDir)) throw new Error('Invalid path');
Check for essential headers:
Content-Security-Policy: default-src 'self'
X-Content-Type-Options: nosniff
X-Frame-Options: DENY
X-XSS-Protection: 1; mode=block
Strict-Transport-Security: max-age=31536000; includeSubDomains
Referrer-Policy: strict-origin-when-cross-origin
Permissions-Policy: geolocation=(), microphone=()
# Security Audit Report
## Summary
- Critical: X
- High: X
- Medium: X
- Low: X
## Critical Findings
[Immediate action required]
## High Priority
[Fix before next release]
## Medium Priority
[Address in next sprint]
## Low Priority
[Technical debt backlog]
## Recommendations
1. ...
2. ...
| Level | Description | Example |
|---|---|---|
| Critical | Active exploit possible | SQL injection, RCE |
| High | Data exposure likely | Auth bypass, IDOR |
| Medium | Conditional risk | Missing headers, weak crypto |
| Low | Best practice | Verbose errors, old TLS |