Security Audit

---
name: security-audit
description: Audits a file or directory for security vulnerabilities (OWASP Top 10 focus)
argument-hint: [file-or-directory]
user-invocable: true
allowed-tools: Read Grep Glob
effort: medium
---

## Security Audit

Target: **$1** (or entire `src/` if not specified)

Check for each OWASP Top 10 category:

### A01 - Broken Access Control
- Routes missing auth middleware
- Direct object references without ownership check
- Admin endpoints without role check

### A02 - Cryptographic Failures
- Hardcoded secrets or keys
- Weak hashing (MD5, SHA1 for passwords)
- HTTP instead of HTTPS for sensitive data
- Sensitive data stored in localStorage

### A03 - Injection
- SQL string concatenation (not parameterized queries)
- Unsanitized input passed to `eval()`, `exec()`, `child_process`
- Template injection risks

### A04 - Insecure Design
- Missing rate limiting on auth endpoints
- No account lockout after failed attempts

### A05 - Security Misconfiguration
- Debug mode enabled in production
- Overly permissive CORS (`*`)
- Default credentials

### A07 - Auth & Session Failures
- Weak JWT validation
- Missing token expiry
- Session not invalidated on logout

---

Report findings as:
- **CRITICAL** - immediate action required
- **HIGH** - fix before next release
- **MEDIUM** - fix in next sprint
- **INFO** - best practice recommendation