# API keys and tokens
grep -rn "api[_-]?key\s*=\s*['\"][^'\"]*['\"]" src/ --include="*.py"
grep -rn "token\s*=\s*['\"][^'\"]*['\"]" src/ --include="*.py"
grep -rn "secret\s*=\s*['\"][^'\"]*['\"]" src/ --include="*.py"

# Passwords
grep -rn "password\s*=\s*['\"][^'\"]*['\"]" src/ --include="*.py"
grep -rn "passwd\s*=\s*['\"]" src/ --include="*.py"

# Connection strings with embedded credentials
grep -rn "://[^:]+:[^@]+@" src/ --include="*.py"
grep -rn "DATABASE_URL\s*=\s*['\"]" src/ --include="*.py"

# AWS credentials
grep -rn "AKIA[0-9A-Z]{16}" src/
grep -rn "aws_secret_access_key" src/ --include="*.py"

# Private keys
grep -rn "BEGIN.*PRIVATE KEY" src/
grep -rn "BEGIN RSA" src/

# Generic high-entropy strings (potential secrets)
# Look for strings longer than 30 chars that look like keys/tokens
grep -rn "['\"][A-Za-z0-9+/=]{32,}['\"]" src/ --include="*.py"

# Secrets and environment
.env
.env.*
!.env.example
*.pem
*.key
*.p12
*.pfx

# Credentials
credentials.json
service-account*.json
*secret*.json
*.keystore

# IDE and OS
.idea/
.vscode/settings.json
.DS_Store
Thumbs.db

# Python
__pycache__/
*.pyc
.venv/
venv/

# Data (if applicable)
*.csv
*.sqlite
*.db
data/raw/

# Check if any .env files are tracked
git ls-files | grep -E "\.env$|\.env\." | grep -v ".example"

# Check for key/certificate files
git ls-files | grep -E "\.(pem|key|p12|pfx|keystore)$"

# Check for credential files
git ls-files | grep -E "(credentials|secret|service.account).*\.json$"

# Check git history for previously committed secrets
git log --all --diff-filter=A --name-only --pretty=format: | grep -E "\.(env|pem|key)$"

# Direct request access without schema validation
grep -rn "request\.json\|request\.form\|request\.args\|request\.data" src/
grep -rn "request\.query_params\|request\.body()" src/

# Unvalidated path parameters
grep -rn "Path(\.\.\." src/ | grep -v "description"

# Raw string concatenation with user input
grep -rn "f\".*{.*request\|f\".*{.*param\|f\".*{.*query" src/

# Raw SQL with string formatting
grep -rn "\.execute(f\"" src/ --include="*.py"
grep -rn "\.execute(\".*%s" src/ --include="*.py"
grep -rn "\.execute(\".*\" +" src/ --include="*.py"
grep -rn "\.execute(\".*\" \." src/ --include="*.py"
grep -rn "\.execute(\".*\.format(" src/ --include="*.py"

# Raw SQL in text() without bound parameters
grep -rn "text(f\"" src/ --include="*.py"
grep -rn "text(\".*\.format" src/ --include="*.py"

# String concatenation in WHERE clauses
grep -rn "WHERE.*\" \+" src/ --include="*.py"
grep -rn "WHERE.*f\"" src/ --include="*.py"

# Raw queries bypassing ORM
grep -rn "raw_connection\|raw_sql\|execute_raw" src/ --include="*.py"

# cursor.execute with string formatting
grep -rn "cursor\.execute(f\"" src/ --include="*.py"

# Jinja2 with autoescape disabled
grep -rn "autoescape\s*=\s*False" src/ --include="*.py"
grep -rn "Markup(" src/ --include="*.py"
grep -rn "|safe" src/ templates/ --include="*.html"
grep -rn "{% autoescape false %}" templates/ --include="*.html"

# Direct HTML construction with user input
grep -rn "f\"<.*{.*}.*>\"" src/ --include="*.py"
grep -rn "HTMLResponse(f\"" src/ --include="*.py"
grep -rn "\.format(.*user\|\.format(.*input\|\.format(.*param" src/ --include="*.py"

# innerHTML or document.write in JavaScript
grep -rn "innerHTML\s*=" src/ static/ templates/ --include="*.js" --include="*.html"
grep -rn "document\.write(" src/ static/ templates/ --include="*.js" --include="*.html"
grep -rn "v-html=" src/ templates/ --include="*.html" --include="*.vue"

# React dangerouslySetInnerHTML
grep -rn "dangerouslySetInnerHTML" src/ --include="*.jsx" --include="*.tsx"

# Find auth implementation
grep -rn "authenticate\|login\|sign_in\|verify_password" src/ --include="*.py"
grep -rn "JWT\|jwt\|JsonWebToken" src/ --include="*.py"
grep -rn "session\[.*user\|current_user" src/ --include="*.py"

# Password hashing
grep -rn "hashlib\|md5\|sha1\|sha256" src/ --include="*.py"  # Weak hashing
grep -rn "bcrypt\|argon2\|scrypt\|pbkdf2" src/ --include="*.py"  # Strong hashing

# Token configuration
grep -rn "expire\|expir\|ttl\|lifetime" src/ --include="*.py"
grep -rn "SECRET_KEY\|JWT_SECRET\|SIGNING_KEY" src/ --include="*.py"

# Find authorization patterns
grep -rn "permission\|role\|authorize\|is_admin\|is_superuser" src/ --include="*.py"
grep -rn "Depends(.*auth\|Depends(.*permission\|Depends(.*role" src/ --include="*.py"

# Find endpoints without auth dependencies
# Compare list of all endpoints vs endpoints with auth
grep -rn "@router\.\|@app\." src/ --include="*.py" | grep -v "Depends.*auth"

# pip-audit (preferred)
pip-audit --requirement requirements.txt
# or
pip-audit --desc

# safety (alternative)
safety check --full-report

# If using poetry
poetry audit

# Check for outdated packages
pip list --outdated

# Check for packages with known issues
pip-audit --fix --dry-run

# File open with user-controlled paths
grep -rn "open(.*request\|open(.*param\|open(.*user" src/ --include="*.py"
grep -rn "open(f\"" src/ --include="*.py"

# Path construction with user input
grep -rn "os\.path\.join(.*request\|os\.path\.join(.*user" src/ --include="*.py"
grep -rn "Path(.*request\|Path(.*user\|Path(.*param" src/ --include="*.py"

# File operations
grep -rn "shutil\.\|os\.remove\|os\.unlink\|os\.rename" src/ --include="*.py"
grep -rn "send_file\|send_from_directory\|FileResponse" src/ --include="*.py"

# Subprocess with file paths
grep -rn "subprocess\.\|os\.system\|os\.popen" src/ --include="*.py"

import os
from pathlib import Path

UPLOAD_DIR = Path("/app/uploads").resolve()

def safe_file_path(user_filename: str) -> Path:
    """Resolve and validate file path against allowed directory."""
    safe_name = Path(user_filename).name  # Strip directory components
    full_path = (UPLOAD_DIR / safe_name).resolve()
    if not str(full_path).startswith(str(UPLOAD_DIR)):
        raise ValueError("Path traversal attempt detected")
    return full_path

# Stack traces in responses
grep -rn "traceback\|format_exc\|print_exc\|exc_info" src/ --include="*.py"
grep -rn "DEBUG\s*=\s*True" src/ --include="*.py"

# Verbose error messages
grep -rn "str(exc)\|str(e)\|repr(e)" src/ --include="*.py"

# Exception details in HTTP responses
grep -rn "detail=str(\|detail=repr(\|detail=.*exc" src/ --include="*.py"
grep -rn "HTTPException.*detail=.*Error" src/ --include="*.py"

# Database errors exposed
grep -rn "IntegrityError\|OperationalError\|ProgrammingError" src/ --include="*.py"

# Sensitive data in logs
grep -rn "logger\.\|logging\.\|log\." src/ --include="*.py" | grep -i "password\|secret\|token\|key"
grep -rn "print(" src/ --include="*.py" | grep -i "password\|secret\|token"

# Security Audit Report

**Project:** {project_name}
**Date:** {date}
**Auditor:** Claude AI
**Scope:** {directories/files audited}

## Executive Summary

- Total findings: {count}
- Critical: {count}
- High: {count}
- Medium: {count}
- Low: {count}

## Findings

### [CRITICAL-001] {Title}

- **Severity:** CRITICAL
- **OWASP Category:** A03 - Injection
- **CWE:** CWE-89 (SQL Injection)
- **Location:** `src/project/api/routers/users.py:45`
- **Description:** Raw SQL query constructed with f-string using unvalidated user input.
- **Evidence:**
  ```python
  # Line 45
  query = f"SELECT * FROM users WHERE name = '{request.query_params['name']}'"

**Report rules:**
- Every finding must have a specific file path and line number.
- Every finding must have a code example showing the vulnerability.
- Every finding must have a remediation code example.
- Severity ratings follow standard definitions:
  - **CRITICAL**: Exploitable with significant impact. Fix immediately.
  - **HIGH**: Exploitable or high impact. Fix within days.
  - **MEDIUM**: Potential risk or defense-in-depth gap. Fix within sprint.
  - **LOW**: Minor issue or hardening recommendation. Fix when convenient.
- Findings are ordered by severity (Critical first, then High, Medium, Low).
- Include the OWASP coverage matrix to show audit completeness.

---

## Enforced Standards

### Google-Style Docstrings (MANDATORY)
Every function, method, and class written or modified during the security audit MUST have a Google-style docstring. No exceptions. This includes:
- One-line summary in imperative mood
- Args section for all parameters
- Returns section describing what is returned
- Raises section for all exceptions
- See CLAUDE.md [STANDARDS] for full specification and examples.

### Git Commit Format (MANDATORY)
All commits created during the security audit MUST follow this format:
- **Signed commits**: Always use `git commit -S`
- **Semantic prefix**: `feat:`, `fix:`, `refactor:`, `test:`, `docs:`, `chore:`, `ci:`
- **File-change table** in the commit body:

- See CLAUDE.md [GIT] for full specification.

---

## Completion Checklist

- [ ] Scanned for hardcoded secrets (API keys, passwords, tokens, connection strings)
- [ ] Verified .gitignore covers all sensitive file patterns
- [ ] Confirmed no sensitive files are tracked in git history
- [ ] Reviewed input validation on all external boundaries
- [ ] Checked all database queries for SQL injection patterns
- [ ] Verified parameterized queries used throughout
- [ ] Scanned for XSS vulnerabilities in HTML/template rendering
- [ ] Verified autoescape enabled in template engines
- [ ] Reviewed password hashing (must be bcrypt/argon2/scrypt)
- [ ] Verified JWT token expiration and signing algorithm
- [ ] Confirmed all sensitive endpoints require authentication
- [ ] Checked for IDOR (users accessing other users' resources)
- [ ] Verified role-based authorization on admin endpoints
- [ ] Ran pip-audit or safety for dependency CVEs
- [ ] Verified all dependencies are pinned
- [ ] Checked for path traversal in file operations
- [ ] Verified file paths are resolved and validated against allowed directories
- [ ] Confirmed no stack traces leaked in production error responses
- [ ] Verified sensitive data not present in logs
- [ ] Confirmed security events are logged (auth, permissions)
- [ ] Generated structured report with all findings
- [ ] Every finding has file path, line number, evidence, and remediation
- [ ] OWASP Top 10 coverage matrix completed
- [ ] Report shared with user and remediation plan discussed