Security Scan

Run a comprehensive security scan on the codebase.

Iron Law

> No "probably safe." Verify or flag. > If you cannot confirm a pattern is secure, flag it. False positives are cheap. Missed vulnerabilities are not.

Scan Checklist

1. Hardcoded Secrets (CRITICAL)

grep -rn "password\s*=\|api_key\s*=\|secret\s*=\|token\s*=" src/
grep -rn "BEGIN.*PRIVATE KEY" .
grep -rn "sk-\|pk_\|ghp_\|gho_\|AKIA" src/

Also check for:

• Base64-encoded secrets (long random strings in config)
• Secrets in comments ("// old password was...")
• Secrets in test fixtures that match production patterns

2. SQL Injection

• String concatenation in SQL queries ("SELECT * FROM " + table)
• Raw queries without parameterization
• ORM bypass with raw SQL
• Dynamic table/column names from user input

3. XSS (Cross-Site Scripting)

• dangerouslySetInnerHTML, innerHTML, document.write
• Template rendering with unescaped user input ({!! !!}, | safe, ``)
• URL parameters reflected in page without encoding
• SVG/image uploads that could contain scripts

4. Command Injection

• exec(), spawn(), system() with user-controlled input
• Template strings in shell commands
• Unsanitized filenames in file operations

5. Authentication & Authorization

• Routes/endpoints missing auth middleware
• Role checks that can be bypassed (client-side only)
• Password hashing (must be bcrypt/argon2/scrypt — NOT md5/sha1/sha256)
• JWT: check expiry validation, algorithm confusion, secret strength
• Session fixation or missing session regeneration on login

6. Input Validation

• API endpoints accepting unvalidated input
• Missing type checks, length limits, format validation
• File upload: missing type restrictions, size limits, path traversal
• Regex DoS (ReDoS) — catastrophic backtracking patterns

7. Sensitive Data Exposure

• Sensitive data in logs (passwords, tokens, PII)
• Stack traces or internal paths in error responses
• .env files not in .gitignore
• Sensitive data in URL query parameters (logged by proxies)
• Missing HTTPS enforcement

8. Dependency Vulnerabilities

npm audit 2>/dev/null || pip audit 2>/dev/null || true

Check for known CVEs in dependencies.

9. Insecure Configuration

• CORS: overly permissive (Access-Control-Allow-Origin: *)
• Missing security headers (CSP, HSTS, X-Frame-Options)
• Cookie settings: missing httpOnly, secure, sameSite flags
• Debug mode enabled in production config
• Default credentials in config files

Anti-Rationalization

| Excuse | Rebuttal | |--------|----------| | "This is internal/admin-only code" | Internal code gets exposed via SSRF, insider threats, and supply chain attacks. Secure it. | | "We're behind a firewall" | Firewalls fail. Defense in depth means every layer is secure. | | "This secret is only in development" | Dev secrets leak to production. Use env vars and secret managers. | | "Nobody would find this endpoint" | Security through obscurity is not security. Assume attackers find everything. | | "The framework handles this automatically" | Verify. Frameworks have defaults, and defaults get overridden. | | "This is a low-priority app" | Low-priority apps are pivot points. Attackers use them to reach high-priority systems. | | "We'll fix it later" | Later never comes. Flag it now with severity. |

Pre-Delivery Checklist

Before presenting the report, verify:

• [ ] All 9 scan categories were checked (not skipped)
• [ ] Every finding has a file:line reference
• [ ] Severity levels are justified (not guessed)
• [ ] No "probably safe" — each item is verified or flagged
• [ ] Dependency audit command was actually run
• [ ] .env and .gitignore were checked
• [ ] Auth middleware coverage was mapped to routes
• [ ] Passed checks section acknowledges secure patterns found
• [ ] Recommendations are prioritized by actual risk, not alphabetical

Output Format

## Security Scan Report

### Critical (exploit risk — fix immediately)
- [file:line] [vulnerability] — [impact] — [fix]

### High (significant risk)
- [file:line] [vulnerability] — [impact] — [fix]

### Medium (moderate risk)
- [file:line] [vulnerability] — [impact] — [fix]

### Low (minor risk / hardening)
- [file:line] [issue] — [recommendation]

### Passed Checks
- [what looks good — acknowledge secure patterns]

### Prioritized Recommendations
1. [most urgent fix]
2. [next priority]
3. [etc.]

Source & license

This open-source skill is cataloged on AgentStack and links to its original source — we do not rehost the code.

• Author: huzaifa525
• Source: huzaifa525/claude-code-optimizer
• License: MIT
• Homepage: https://www.npmjs.com/package/claude-code-optimizer

Install and usage instructions live in the source repository linked above.