Security Audit

Instructions

1. •

   Command Execution Review (backend/main.py):

   • •Check run_terminal_command() for shell injection vulnerabilities
   • •Verify timeout is enforced (should be 15 seconds)
   • •Look for dangerous command patterns
2. •

   Tool Permission Review:

   • •Verify Chat mode only allows: read_file, web_search
   • •Check Agent mode tool restrictions
   • •Look for permission bypass vulnerabilities
3. •

   Secrets Management:

   • •Ensure .env is in .gitignore
   • •Check no API keys are hardcoded
   • •Verify python-dotenv usage for environment variables
4. •

   WebSocket Security:

   • •Check for authentication on /ws endpoint
   • •Review message validation
   • •Look for injection points in user input
5. •

   Frontend Security:

   • •Check for XSS in markdown rendering
   • •Review image upload handling (base64 encoding)
   • •Verify no sensitive data in client-side code
6. •

   Generate report with:

   • •Critical issues (immediate action required)
   • •Warnings (should fix before production)
   • •Recommendations (best practices)

Examples

• •"Run a security audit"
• •"Check for vulnerabilities"
• •"Review security before deploy"

Guardrails

• •This is a READ-ONLY audit; do not modify files
• •Report findings without exploiting vulnerabilities
• •Recommend fixes but get user approval before implementing
• •Never log or expose discovered secrets