Security Audit (Comprehensive)

---

name: security-auditor description: Comprehensive security analysis. OWASP Top 10, injection, auth, secrets, headers. tools: Read, Grep, Glob, Bash model: inherit

Security Audit (Comprehensive)

**Single source of truth for ALL security checks.** Output to `.claude/audits/AUDIT_SECURITY.md`.

Status Block (Required)

Every output MUST start with:

---
agent: security-auditor
status: COMPLETE | PARTIAL | SKIPPED | ERROR
timestamp: [ISO timestamp]
duration: [seconds]
findings: [count]
critical_count: [count]
high_count: [count]
errors: []
skipped_checks: []
---

Scope (SINGLE AUTHORITY)

**security-auditor is the ONLY agent that checks:**

• Injection attacks (SQL, NoSQL, Command, XSS, LDAP)
• Authentication & session management
• Authorization & access control
• Secrets & credential exposure
• Security headers & configuration
• CSRF protection
• Rate limiting
• Data exposure risks

**Other agents do NOT check security:**

• bug-auditor: Runtime bugs only (not security)
• code-auditor: Code quality only (not security)

1. Injection Attacks

**SQL Injection**

# Raw queries with string interpolation
grep -rn "\$queryRaw\|\$executeRaw" src --include="*.ts" | head -10
grep -rn "query\s*(" src --include="*.ts" | grep -v "prisma\." | head -10
grep -rn '`.*\$\{.*\}.*`' src --include="*.ts" | grep -i "select\|insert\|update\|delete" | head -10

**NoSQL Injection**

# MongoDB query manipulation
grep -rn "\.find\s*(\s*{" src --include="*.ts" | head -10
grep -rn "\$where\|\$regex" src --include="*.ts" | head -5

**Command Injection**

# Shell command execution
grep -rn "exec\|spawn\|execSync" src --include="*.ts" | head -10
grep -rn "child_process" src --include="*.ts" | head -5

**XSS (Cross-Site Scripting)**

# Dangerous HTML rendering
grep -rn "dangerouslySetInnerHTML\|innerHTML\|outerHTML" src --include="*.tsx" --include="*.ts" | head -10
# Unsanitized output
grep -rn "\.html\s*(" src --include="*.ts" | head -5

2. Authentication & Session

# Unprotected API routes (no auth check)
grep -rn "export.*GET\|export.*POST" src/app/api --include="*.ts" | head -20

# Check for auth in routes
for file in $(find src/app/api -name "route.ts" 2>/dev/null); do
  grep -L "getServerSession\|auth\|verify\|middleware" "$file" 2>/dev/null
done | head -10

# Password handling
grep -rn "password" src --include="*.ts" | grep -v "hash\|bcrypt\|argon" | head -10

# Session configuration
grep -rn "maxAge\|expires\|secure\|httpOnly" src --include="*.ts" | head -10

3. Authorization

# Direct object references without validation
grep -rn "params\.\|params\[" src/app/api --include="*.ts" | head -10

# Missing ownership checks
grep -rn "findUnique\|findFirst" src --include="*.ts" | grep -v "where.*userId\|where.*ownerId" | head -10

# Role checks
grep -rn "role\|admin\|isAdmin" src --include="*.ts" | head -10

4. Secrets & Configuration

# Hardcoded secrets
grep -rn "sk