security-checks

What this skill does

# Security Checks

## Stable Detection Patterns

These patterns have low false-positive rates and rarely change. Apply consistently across all reviews.

### 1. Hardcoded Credentials

**Detection**: API keys, passwords, tokens, secrets embedded in source code.

**Search patterns**: String literals matching `password`, `secret`, `api_key`, `token`, `apiKey`, `API_KEY`, `Bearer`, `Basic` followed by base64-like strings, AWS access key patterns (`AKIA...`), private key headers (`-----BEGIN`).

```
BAD:  const API_KEY = "sk-abc123def456";
BAD:  password: "admin123"
BAD:  Authorization: "Bearer eyJhbGciOiJIUzI1NiIs..."

GOOD: const API_KEY = process.env.API_KEY;
GOOD: password: config.get("db.password")
GOOD: Authorization: `Bearer ${getToken()}`
```

**Severity**: Critical (always blocked)

### 2. SQL Injection

**Detection**: User input concatenated into SQL queries instead of parameterized queries.

**Search patterns**: String concatenation or template literals containing SQL keywords (`SELECT`, `INSERT`, `UPDATE`, `DELETE`, `WHERE`) with variable interpolation.

```
BAD:  db.query(`SELECT * FROM users WHERE id = ${userId}`);
BAD:  db.query("SELECT * FROM users WHERE name = '" + name + "'");

GOOD: db.query("SELECT * FROM users WHERE id = $1", [userId]);
GOOD: db.query("SELECT * FROM users WHERE name = ?", [name]);
```

**Severity**: Critical

### 3. Cross-Site Scripting (XSS)

**Detection**: Unescaped user input rendered in HTML output.

**Search patterns**: `innerHTML`, `dangerouslySetInnerHTML`, `document.write`, `eval()` with user-controlled input, template literals in HTML context without sanitization.

```
BAD:  element.innerHTML = userInput;
BAD:  <div dangerouslySetInnerHTML={{__html: userComment}} />

GOOD: element.textContent = userInput;
GOOD: <div>{DOMPurify.sanitize(userComment)}</div>
```

**Severity**: High

### 4. Path Traversal

**Detection**: User input used in file system paths without sanitization.

**Search patterns**: `fs.readFile`, `fs.writeFile`, `path.join`, `path.resolve` with user-controlled segments, presence of `../` in path inputs without validation.

```
BAD:  fs.readFile(path.join(uploadsDir, req.params.filename));
BAD:  const file = `./data/${userInput}`;

GOOD: const safeName = path.basename(req.params.filename);
      fs.readFile(path.join(uploadsDir, safeName));
GOOD: if (resolved.startsWith(allowedDir)) { fs.readFile(resolved); }
```

**Severity**: High

### 5. Insecure Deserialization

**Detection**: Deserializing data from untrusted sources without validation.

**Search patterns**: `JSON.parse` on external input without schema validation, `eval()` for data parsing, `unserialize` on user data, `yaml.load` (unsafe) vs `yaml.safeLoad`.

```
BAD:  const data = JSON.parse(req.body);
      processOrder(data.orderId, data.amount);

GOOD: const data = orderSchema.parse(JSON.parse(req.body));
      processOrder(data.orderId, data.amount);
```

**Severity**: High

### 6. Weak Cryptography

**Detection**: Use of deprecated or weak cryptographic algorithms for security purposes.

**Search patterns**: `MD5`, `SHA1` used for password hashing or security tokens, `DES`, `3DES`, `RC4` for encryption, `ECB` mode, key sizes < 256 bits for symmetric encryption.

```
BAD:  crypto.createHash("md5").update(password).digest("hex");
BAD:  crypto.createCipheriv("aes-128-ecb", key, null);

GOOD: await bcrypt.hash(password, 12);
GOOD: crypto.createCipheriv("aes-256-gcm", key, iv);
```

**Severity**: High (passwords), Medium (other uses)

### 7. Server-Side Request Forgery (SSRF)

**Detection**: User-controlled URLs used in server-side HTTP requests.

**Search patterns**: `fetch`, `axios`, `http.get`, `request` with user-provided URL or hostname, URL construction from user input without allowlist validation.

```
BAD:  const response = await fetch(req.query.url);
BAD:  const data = await axios.get(`http://${userHost}/api`);

GOOD: if (ALLOWED_HOSTS.includes(new URL(url).hostname)) {
        const response = await fetch(url);
      }
```

**Severity**: High

### 8. Open Redirects

**Detection**: User-controlled redirect targets without validation.

**Search patterns**: `res.redirect`, `window.location`, `location.href` with user input, `returnUrl`, `redirectTo`, `next` parameters used directly.

```
BAD:  res.redirect(req.query.returnUrl);
BAD:  window.location.href = params.get("next");

GOOD: const url = new URL(req.query.returnUrl, APP_ORIGIN);
      if (url.origin === APP_ORIGIN) res.redirect(url.toString());
```

**Severity**: Medium

## Trend-Sensitive Patterns

These patterns require awareness of current threats. Use WebSearch to verify latest advisories when reviewing.

### 9. Dependency Vulnerabilities

**Detection**: Known CVEs in project dependencies.

**Action**: Check `package.json`, `requirements.txt`, `go.mod`, or equivalent against recent advisories.

**WebSearch queries**:
- "[package-name] CVE [current-year]"
- "[package-name] security advisory"
- "npm audit [package-name]"

**Severity**: Varies by CVE (Critical to Low)

### 10. API Key Exposure

**Detection**: API keys, tokens, or secrets accessible in client-side code or git history.

**Search patterns**:
- Keys in client-side bundles (files under `public/`, `static/`, client-side imports)
- Keys committed to git history (`git log -p --all -S "API_KEY"`)
- Keys in `.env` files committed to repository
- Environment variables prefixed with `NEXT_PUBLIC_`, `VITE_`, `REACT_APP_` containing secrets

```
BAD:  // client-side file
      const STRIPE_SECRET = "sk_live_abc123";

GOOD: // server-side only, never exposed to client
      const STRIPE_SECRET = process.env.STRIPE_SECRET_KEY;
```

**Severity**: Critical (production keys), High (development keys)

### 11. JWT Misconfigurations

**Detection**: Insecure JWT implementation patterns.

**Search patterns**: `algorithm: "none"`, `algorithms: ["HS256", "none"]`, missing `expiresIn`, symmetric secrets < 256 bits, `verify: false`, missing audience/issuer validation.

```
BAD:  jwt.sign(payload, "secret123");
BAD:  jwt.verify(token, secret, { algorithms: ["HS256", "none"] });

GOOD: jwt.sign(payload, process.env.JWT_SECRET, {
        algorithm: "RS256",
        expiresIn: "1h",
        audience: "api.example.com",
        issuer: "auth.example.com"
      });
```

**Severity**: Critical (algorithm none), High (weak secret/no expiry)

## Severity Classification Guide

| Severity | Impact | Action Required |
|----------|--------|-----------------|
| **Critical** | Direct exploitation possible, data breach risk | Immediate fix, blocks deployment |
| **High** | Exploitable with moderate effort, significant impact | Fix before release |
| **Medium** | Limited exploitability or impact | Fix in next sprint |
| **Low** | Minimal risk, defense-in-depth improvement | Track as tech debt |

### Aggregation Rules

- 1+ Critical finding → status: `blocked`
- 1+ High finding (confirmed_risk) → status: `needs_revision`
- Only Medium/Low findings → status: `approved_with_notes`
- No findings → status: `approved`

## Expert References (Reasoning Calibration)

When facing security assessment decisions, calibrate your reasoning against these established principles:

| Expert | Key Principle | Apply When |
|--------|--------------|------------|
| OWASP | "Never trust input" | Reviewing any data from external sources |
| Saltzer & Schroeder | "Fail-safe defaults — deny by default" | Evaluating access control implementations |
| Kerckhoffs | "Security must not depend on secrecy of the mechanism" | Reviewing hardcoded secrets or security-through-obscurity |
| NIST | "Use approved cryptographic algorithms and key lengths" | Evaluating cryptographic implementations |