Security Scan - Security Audit System

VETO POWER

WARNING: This skill HAS VETO POWER. If critical vulnerability detected, MUST:

1. •STOP implementation
2. •REPORT vulnerability
3. •REQUIRE fix before proceeding

Purpose

This skill audits code security:

• •Validates user ID comes from session (NEVER from request)
• •Detects sensitive data being sent to frontend
• •Verifies Zod validation on all routes
• •Audits against OWASP Top 10
• •Blocks commits with critical vulnerabilities

Critical Security Rules

1. USER ID ALWAYS FROM SESSION

NEVER trust user ID from frontend. ALWAYS extract from ctx.session.userId or ctx.user._id.

// WRONG - VULNERABLE (IMMEDIATE VETO)
async function getData({ userId }: { userId: string }) {
	return db.find({ userId }); // userId can be manipulated!
}

// CORRECT
async function getData({ ctx }: { ctx: Context }) {
	const userId = ctx.user._id; // Always from session
	return db.find({ userId });
}

2. SENSITIVE DATA NEVER TO FRONTEND

NEVER send to frontend:

• •Passwords (even hashed)
• •API tokens
• •Secret keys
• •Other users' data
• •Stack traces in production

// WRONG - DATA LEAK (IMMEDIATE VETO)
return {
	user: await UserModel.findById(id), // Includes passwordHash!
};

// CORRECT
return {
	user: user.toPublic(), // Sanitization method
};

3. ZOD VALIDATION REQUIRED

EVERY tRPC route MUST have .input(z.object({...})). Unvalidated inputs are attack vectors.

// WRONG - NO VALIDATION (IMMEDIATE VETO)
.mutation(async ({ input }) => {
  await db.create(input); // input can have anything!
})

// CORRECT
.input(createSchema) // Zod schema
.mutation(async ({ input }) => {
  await db.create(input); // input is validated
})

OWASP Top 10 Checklist

A01: Broken Access Control

• • All protected routes use protectedProcedure?
• • User ID from session, not input?
• • Resources filtered by user/tenant?

A02: Cryptographic Failures

• • Passwords hashed with bcrypt (salt >= 10)?
• • Tokens generated with crypto.randomBytes?
• • Cookies with HttpOnly, Secure, SameSite?
• • No secrets in code (use env vars)?

A03: Injection

• • Queries use Mongoose (prevents NoSQL injection)?
• • Inputs validated with Zod?
• • No string concatenation in queries?

A07: Authentication Failures

• • Passwords with minimum requirements?
• • Brute force protection?
• • Sessions invalidated on logout?
• • Tokens with expiration?

Detection Patterns

Detect User ID from Input (VETO)

grep -r "input\.userId\|input\.user_id\|{ userId }" server/ --include="*.ts"

Detect Password Return (VETO)

grep -r "passwordHash\|password:" server/ --include="*.ts"

Detect Route Without Validation (VETO)

grep -A5 "Procedure\." server/ --include="*.ts" | grep -v ".input("

Output Format

Approved

## SECURITY SCAN - APPROVED

### Scope

- **Files:** X
- **Routes:** Y

### Checks

- [x] User ID always from session
- [x] No sensitive data in response
- [x] All routes with Zod validation
- [x] OWASP Top 10 OK

**STATUS: APPROVED**

Vetoed

## SECURITY SCAN - VETOED

### CRITICAL VULNERABILITY

**Type:** User ID from Input
**File:** `server/routers/example.ts:45`
**Risk:** Any user can access other users' data

**Fix:** Use `ctx.user._id` instead of `input.userId`

**STATUS: VETOED** - Fix before proceeding

VETO Rules

IMMEDIATE VETO

1. •User ID from input/request body
2. •Password returned in response
3. •API tokens exposed
4. •Protected route without protectedProcedure
5. •Query without user/tenant filter

VETO BEFORE MERGE

1. •Route without Zod validation
2. •Unsanitized sensitive data
3. •bun audit (or npm audit) with critical vulnerabilities

Progressive Disclosure

For detailed information, see:

• •reference/owasp-top-10.md - Complete OWASP Top 10 checklist with examples
• •scripts/scan.py - Automated security scanner

Quick Scan

python .claude/skills/security-scan/scripts/scan.py server/

Version

• •v2.1.0 - Added progressive disclosure with reference files and scan script
• •v2.0.0 - Generic template