From dx-core
Security hardening audit — OWASP Top 10 prevention, secrets scan, dependency audit, input validation, auth review. Use before PR or when handling user input, authentication, or external integrations.
npx claudepluginhub easingthemes/dx-aem-flow --plugin dx-coreThis skill is limited to using the following tools:
You perform a security audit of the codebase, checking for OWASP Top 10 vulnerabilities, secrets exposure, dependency vulnerabilities, and hardening gaps.
Performs OWASP Top 10-aligned security audits on code, checking injection, broken access control, cryptographic failures, misconfigurations, and more.
Conducts OWASP Top 10 security audits and dependency vulnerability checks via Codex MCP. Analyzes git changes and security files like auth/password. Outputs findings report and gates merges.
Mandates invoking relevant skills via tools before any response in coding sessions. Covers access, priorities, and adaptations for Claude Code, Copilot CLI, Gemini CLI.
Share bugs, ideas, or general feedback.
You perform a security audit of the codebase, checking for OWASP Top 10 vulnerabilities, secrets exposure, dependency vulnerabilities, and hardening gaps.
changes (default) — audit only files changed since base branchfull — audit the entire codebaseGet the file list:
# changes mode
BASE=$(git merge-base $(git symbolic-ref refs/remotes/origin/HEAD --short 2>/dev/null || echo origin/main) HEAD)
git diff --name-only $BASE..HEAD
# full mode
find . -type f \( -name '*.js' -o -name '*.ts' -o -name '*.java' -o -name '*.py' -o -name '*.jsx' -o -name '*.tsx' -o -name '*.xml' -o -name '*.yaml' -o -name '*.yml' -o -name '*.json' \) | grep -v node_modules | grep -v target
Read shared/security-checklist.md for the full checklist reference.
These must be present in every project. Flag if missing:
npm audit / mvn dependency-check)These require explicit team decision:
Flag these as Critical — merge-blocking:
eval() or innerHTML with untrusted dataGrep: @PreAuthorize|@Secured|authorize|isAuthenticated|hasRole — check auth exists on protected endpoints
Flag endpoints without authorization checks. "Always check authorization, not just authentication."
Grep: MD5|SHA1|sha1|md5|DES|RC4 — weak cryptography
Grep: http:// — unencrypted communication (should be https)
Grep: \+ .*\.(query|execute|sql|raw) — string concatenation in queries
Grep: innerHTML|outerHTML|document\.write|\.html\( — DOM injection
Grep: eval\(|Function\(|setTimeout\(["'] — code injection
Check for missing rate limiting on auth endpoints, missing CSRF tokens on state-changing operations.
Grep: Access-Control-Allow-Origin.*\* — overly permissive CORS
Grep: debug.*=.*true|DEBUG.*=.*1 — debug mode in production config
npm audit --json 2>/dev/null | head -100
mvn dependency-check:check 2>/dev/null | tail -50
Grep: password.*=.*["']|token.*=.*["']|secret.*=.*["'] — hardcoded credentials
Grep: bcrypt|argon2|scrypt|pbkdf2 — verify proper password hashing exists
Check for unsigned/unverified downloads, missing SRI attributes on CDN scripts.
Grep: console\.log.*password|console\.log.*token|log\.(info|debug).*secret — sensitive data in logs
Verify security events ARE logged: failed logins, permission denials, input validation failures.
Grep: fetch\(|axios\(|http\.get\(|request\( — check if user input flows into URLs
Go beyond basic grep — check comprehensively:
# Check git history for secrets
git log --all --diff-filter=A -- '*.env' '*.pem' '*.key' '*credentials*' '*secret*' 2>/dev/null | head -20
# Check current files
grep -rn 'AKIA[0-9A-Z]\{16\}' . --include='*.{js,ts,java,py,yaml,json,xml}' 2>/dev/null # AWS keys
grep -rn 'password\s*=\s*["\x27][^"\x27]\{8,\}' . --include='*.{js,ts,java,py,yaml,json,properties}' 2>/dev/null # Hardcoded passwords
grep -rn 'Bearer [a-zA-Z0-9._-]\{20,\}' . --include='*.{js,ts,java,py}' 2>/dev/null # Bearer tokens
Verify .env is in .gitignore. Verify .env.example has placeholder values only.
For every endpoint or form handler in changed files:
## Security Audit: <scope>
**Files scanned:** <N>
**Issues found:** <N critical> / <N important> / <N advisory>
### Critical Issues (merge-blocking)
| # | Category | File | Line | Issue | Fix |
|---|----------|------|------|-------|-----|
| 1 | A03 Injection | `file.js` | L42 | innerHTML with user input | Use textContent or sanitize with DOMPurify |
### Important Issues (should fix before merge)
| # | Category | File | Line | Issue | Fix |
|---|----------|------|------|-------|-----|
### Advisory (team should review)
| # | Category | File | Line | Issue |
|---|----------|------|------|-------|
### Checks Passed
- [ ] No secrets in source or git history
- [ ] Dependencies clean (no critical/high vulnerabilities)
- [ ] Input validated at all entry points
- [ ] Output encoded (XSS prevention)
- [ ] Auth + authz on protected endpoints
- [ ] Security headers present
- [ ] Error messages don't expose internals
| False Logic | Reality Check |
|---|---|
| "It's an internal tool, security doesn't matter" | Internal systems are primary attack targets — they have the most access and least scrutiny. |
| "We'll add security later" | Retrofitting security costs 10x more than building it in. And "later" means "after the breach." |
| "Nobody would think to try that" | Automated scanners try everything. Your obscure endpoint is in somebody's wordlist. |
| "The framework handles security" | Frameworks provide tools, not guarantees. One dangerouslySetInnerHTML undoes all of React's XSS protection. |
| "It's just a prototype" | Prototypes become production. Security debt in prototypes becomes production vulnerabilities. |
| "We have a WAF, it'll catch it" | Defense in depth. The WAF catches known patterns; your custom logic creates unknown ones. |
/dx-security
Scans files changed since base branch for OWASP Top 10 issues, secrets, and dependency vulnerabilities.
/dx-security full
Comprehensive scan of all source files.
Cause: Transitive dependencies with known CVEs.
Fix: Run npm audit fix. For unfixable ones, check if they're dev-only dependencies (lower risk). Document accepted risks.
Cause: Test files contain dummy passwords/tokens for testing. Fix: Verify the flagged content is not a real secret. If it's a test fixture, add a comment explaining it's intentional.
@SuppressWarnings or // nosec