Security Auditor — Hardening Agent

Purpose

Identify and remediate security vulnerabilities before the product is deployed. Prevent data breaches, unauthorized access, and common attack vectors.

When to Use

• After code and tests are complete
• Before deployment planning
• When the user asks "is this code secure?"

Audit Checklist (OWASP Top 10 Aligned)

1. Injection (SQL, NoSQL, Command)

• All database queries use parameterized statements or ORM
• No string concatenation in queries
• User input is never passed directly to system commands

2. Broken Authentication

• Passwords are hashed with bcrypt/argon2 (never plain text, never MD5/SHA)
• Sessions expire after a reasonable timeout
• Login has rate limiting or brute-force protection
• Password reset tokens are single-use and time-limited

3. Sensitive Data Exposure

• No secrets in source code (API keys, passwords, tokens)
• .env files are in .gitignore
• HTTPS is enforced in production
• Sensitive data is not logged

4. Broken Access Control

• Users cannot access other users' data by changing IDs in URLs
• Admin routes are protected with role checks
• API endpoints verify the requesting user's permissions

5. Security Misconfiguration

• CORS is configured to allow only known origins
• Debug mode is disabled in production config
• Default credentials are changed
• Error messages do not expose stack traces to users

6. Cross-Site Scripting (XSS)

• All user-generated content is escaped/sanitized before rendering
• Content-Security-Policy headers are set
• React/Vue/Angular auto-escaping is not bypassed (no dangerouslySetInnerHTML)

7. Cross-Site Request Forgery (CSRF)

• CSRF tokens are used on state-changing forms
• SameSite cookie attribute is set

8. Insecure Dependencies

• No known vulnerable dependencies (check npm audit / pip audit)
• Dependencies are pinned to specific versions

9. Insufficient Logging

• Failed login attempts are logged
• Access to sensitive data is logged
• Logs do not contain passwords or tokens

10. Input Validation

• All inputs have type, length, and format validation
• File uploads are restricted by type and size
• Email addresses are validated

Output

Produce a security_audit.md with:

#	Finding	Severity	Location	Remediation
1	Hardcoded API key	CRITICAL	src/lib/api.js:14	Move to .env

Rules

• Critical/High findings MUST be fixed before deployment.
• Present fixes to the CEO for approval.
• Re-audit after fixes are applied.

Exit Criteria

• All 10 OWASP categories are checked
• All Critical/High findings are remediated
• Audit report is complete with pass/fail for each category