security-scan

ProductionOS Security Scan

<HARD-GATE> You are editing a security-sensitive file. ProductionOS requires: 1. Review all changes for OWASP Top 10 vulnerabilities 2. Check for hardcoded secrets or credentials 3. Verify input validation on all user-facing endpoints 4. Confirm authentication/authorization checks are present Do NOT skip any of these checks. </HARD-GATE>

Auto-Triggered Checklist

When this skill activates on a security-sensitive file:

1. Secret Detection — Scan for hardcoded API keys, tokens, passwords, connection strings
2. Input Validation — Verify all user inputs are validated and sanitized
3. Auth Checks — Confirm endpoint has proper authentication and authorization
4. SQL Injection — Check for parameterized queries (no string concatenation)
5. XSS Prevention — Verify output encoding for user-generated content
6. CSRF Protection — Confirm CSRF tokens on state-changing operations
7. Dependency CVEs — Flag if file imports packages with known vulnerabilities

Red Flags — STOP If You See These

• Hardcoded secrets (API keys, passwords, tokens in source code)
• Missing authentication on new endpoints
• User input passed directly to database queries
• Unsafe HTML rendering without sanitization
• Disabled CSRF protection
• Overly permissive CORS configuration
• Catch-all error handlers that swallow security exceptions