bash ~/.claude/skills/security-checklist/scripts/audit.sh

✅ Requirements:
- [ ] Minimum 12 characters
- [ ] Hashed with bcrypt/argon2 (cost factor ≥ 12)
- [ ] Never stored in plain text
- [ ] Never logged
- [ ] Breach detection (HaveIBeenPwned API)

// ✅ Good: Secure password hashing
import { hash, verify } from 'argon2';

const hashedPassword = await hash(password, {
  type: argon2id,
  memoryCost: 65536,
  timeCost: 3,
  parallelism: 4
});

// ✅ Good: Timing-safe comparison
const isValid = await verify(hashedPassword, inputPassword);

// ✅ Good: PHP password hashing
$hash = password_hash($password, PASSWORD_ARGON2ID, [
    'memory_cost' => 65536,
    'time_cost' => 4,
    'threads' => 3,
]);

// ✅ Good: Timing-safe verification
if (password_verify($inputPassword, $storedHash)) {
    // Valid password
}

// ✅ Laravel: Uses bcrypt by default
$user->password = Hash::make($password);
if (Hash::check($inputPassword, $user->password)) {
    // Valid
}

✅ Checklist:
- [ ] Session ID regenerated after login
- [ ] Session timeout implemented (idle + absolute)
- [ ] Secure cookie flags set
- [ ] Session invalidation on logout
- [ ] Concurrent session limits (optional)

// ✅ Good: Secure cookie settings
app.use(session({
  secret: process.env.SESSION_SECRET,
  name: '__Host-session', // __Host- prefix enforces secure
  cookie: {
    httpOnly: true,       // No JS access
    secure: true,         // HTTPS only
    sameSite: 'strict',   // CSRF protection
    maxAge: 3600000,      // 1 hour
    domain: undefined,    // No cross-subdomain
  },
  resave: false,
  saveUninitialized: false,
}));

✅ Checklist:
- [ ] Use RS256 or ES256 (not HS256 for distributed systems)
- [ ] Short expiration (15 min access, 7 day refresh)
- [ ] Validate all claims (iss, aud, exp, iat)
- [ ] Store refresh tokens securely (httpOnly cookie)
- [ ] Implement token revocation
- [ ] Never store sensitive data in payload

// ❌ Bad: Secrets in JWT
{ "userId": 1, "email": "user@example.com", "ssn": "123-45-6789" }

// ✅ Good: Minimal claims
{ "sub": "user_123", "iat": 1699900000, "exp": 1699900900 }

// ❌ VULNERABLE: String concatenation
const query = `SELECT * FROM users WHERE id = ${userId}`;

// ❌ VULNERABLE: Template literal
const query = `SELECT * FROM users WHERE email = '${email}'`;

// ✅ SAFE: Parameterized query
const user = await db.query(
  'SELECT * FROM users WHERE id = $1',
  [userId]
);

// ✅ SAFE: ORM with proper escaping
const user = await prisma.user.findUnique({
  where: { id: userId }
});

// ❌ VULNERABLE: String interpolation
$query = "SELECT * FROM users WHERE email = '$email'";

// ✅ SAFE: PDO prepared statements
$stmt = $pdo->prepare('SELECT * FROM users WHERE email = :email');
$stmt->execute(['email' => $email]);

// ✅ SAFE: Laravel Eloquent
$user = User::where('email', $email)->first();

// ✅ SAFE: Laravel Query Builder
$user = DB::table('users')->where('email', '=', $email)->first();

// ❌ VULNERABLE: Direct user input
const user = await db.users.findOne({ username: req.body.username });
// Attack: { "username": { "$ne": "" } } → Returns first user!

// ✅ SAFE: Type validation
const username = z.string().parse(req.body.username);
const user = await db.users.findOne({ username });

// ✅ SAFE: Explicit string cast
const user = await db.users.findOne({
  username: String(req.body.username)
});

// ❌ VULNERABLE: Shell command with user input
exec(`convert ${userFilename} output.png`);
// Attack: filename = "; rm -rf /"

// ✅ SAFE: Use array arguments (no shell)
execFile('convert', [userFilename, 'output.png']);

// ✅ SAFE: Whitelist allowed values
const allowed = ['png', 'jpg', 'gif'];
if (!allowed.includes(format)) {
  throw new Error('Invalid format');
}

- [ ] All user output HTML-encoded by default
- [ ] Content-Security-Policy header configured
- [ ] X-Content-Type-Options: nosniff
- [ ] Sanitize HTML if allowing rich text
- [ ] Validate URLs before rendering links

// ❌ VULNERABLE: Raw HTML insertion
element.innerHTML = userInput;
document.write(userInput);

// React ❌ VULNERABLE: dangerouslySetInnerHTML
<div dangerouslySetInnerHTML={{ __html: userInput }} />

// ✅ SAFE: Text content (auto-encoded)
element.textContent = userInput;

// ✅ SAFE: React default behavior
<div>{userInput}</div>

// ✅ SAFE: If HTML needed, use sanitizer
import DOMPurify from 'dompurify';
<div dangerouslySetInnerHTML={{ __html: DOMPurify.sanitize(userInput) }} />

// ❌ VULNERABLE: Raw output
<?php echo $userInput; ?>
<?= $userInput ?>

// ✅ SAFE: Laravel Blade (auto-escaped)
{{ $userInput }}

// ❌ VULNERABLE: Blade raw output
{!! $userInput !!}

// ✅ SAFE: Manual escaping in PHP
<?= htmlspecialchars($userInput, ENT_QUOTES, 'UTF-8') ?>

// ✅ SAFE: Laravel e() helper
<?= e($userInput) ?>

// ✅ Strict CSP header
app.use((req, res, next) => {
  res.setHeader('Content-Security-Policy', [
    "default-src 'self'",
    "script-src 'self'",           // No inline scripts
    "style-src 'self' 'unsafe-inline'", // Or use nonces
    "img-src 'self' data: https:",
    "connect-src 'self' https://api.example.com",
    "frame-ancestors 'none'",      // Clickjacking protection
    "base-uri 'self'",
    "form-action 'self'",
  ].join('; '));
  next();
});

- [ ] CSRF tokens on all state-changing requests
- [ ] SameSite=Strict or Lax on cookies
- [ ] Verify Origin/Referer headers
- [ ] Don't use GET for state changes

// ✅ Token-based CSRF protection
import csrf from 'csurf';

app.use(csrf({ cookie: true }));

// In forms
<input type="hidden" name="_csrf" value={csrfToken} />

// In AJAX
fetch('/api/action', {
  method: 'POST',
  headers: {
    'CSRF-Token': csrfToken,
  },
});

// ✅ Double-submit cookie pattern (for SPAs)
// 1. Set CSRF token in cookie (readable by JS)
res.cookie('csrf', token, {
  httpOnly: false,  // JS needs to read this
  sameSite: 'strict'
});

// 2. Client sends token in header
// 3. Server compares cookie value with header value

❌ Secrets in code
const API_KEY = "sk_live_abc123";

❌ Secrets in git
.env committed to repository

❌ Secrets in logs
console.log(`Connecting with password: ${password}`);

❌ Secrets in error messages
throw new Error(`DB connection failed: ${connectionString}`);

- [ ] Secrets in environment variables or vault
- [ ] .env in .gitignore
- [ ] Different secrets per environment
- [ ] Secrets rotated regularly
- [ ] Access to secrets audited
- [ ] No secrets in client-side code

# If secrets were committed, remove from history
git filter-branch --force --index-filter \
  "git rm --cached --ignore-unmatch path/to/secret-file" \
  --prune-empty --tag-name-filter cat -- --all

# Or use BFG Repo-Cleaner (faster)
bfg --delete-files .env
bfg --replace-text passwords.txt

# Force push (coordinate with team!)
git push origin --force --all

# Rotate ALL exposed secrets immediately!

- [ ] API keys not in URLs (use headers)
- [ ] Rate limiting per user/IP
- [ ] Request signing for sensitive operations
- [ ] OAuth 2.0 for third-party access

// ✅ Validate all input with schema
import { z } from 'zod';

const CreateUserSchema = z.object({
  email: z.string().email().max(255),
  name: z.string().min(1).max(100),
  age: z.number().int().min(0).max(150).optional(),
});

app.post('/users', (req, res) => {
  const result = CreateUserSchema.safeParse(req.body);
  if (!result.success) {
    return res.status(400).json({ error: result.error });
  }
  // result.data is typed and validated
});

// ✅ Don't expose internal errors
app.use((err, req, res, next) => {
  console.error(err); // Log full error internally

  // Return generic message to client
  res.status(500).json({
    error: 'Internal server error',
    requestId: req.id, // For support reference
  });
});

// ✅ Don't expose sensitive fields
const userResponse = {
  id: user.id,
  name: user.name,
  email: user.email,
  // ❌ Never: password, passwordHash, internalId, etc.
};

app.use(helmet()); // Sets many security headers

// Or manually:
res.setHeader('X-Content-Type-Options', 'nosniff');
res.setHeader('X-Frame-Options', 'DENY');
res.setHeader('X-XSS-Protection', '0'); // Disabled, use CSP instead
res.setHeader('Strict-Transport-Security', 'max-age=31536000; includeSubDomains');
res.setHeader('Referrer-Policy', 'strict-origin-when-cross-origin');
res.setHeader('Permissions-Policy', 'camera=(), microphone=(), geolocation=()');

# Check for vulnerabilities
npm audit
pip-audit
cargo audit

# Auto-fix where possible
npm audit fix

# Keep dependencies updated
npx npm-check-updates -u

- [ ] HTTPS only (redirect HTTP)
- [ ] TLS 1.2+ only
- [ ] Security headers configured
- [ ] Debug mode disabled
- [ ] Default credentials changed
- [ ] Unnecessary ports closed
- [ ] File permissions restricted
- [ ] Logging enabled (but no secrets)
- [ ] Backups encrypted
- [ ] WAF/DDoS protection (for public APIs)

# Find hardcoded secrets
grep -rn "password\|secret\|api_key\|token" --include="*.ts" --include="*.js" .

# Check for vulnerable dependencies
npm audit --audit-level=high

# Find TODO security items
grep -rn "TODO.*security\|FIXME.*security\|XXX.*security" .

# Check for console.log in production code
grep -rn "console\.log" src/