mirror of
https://github.com/garrytan/gstack.git
synced 2026-05-07 05:56:41 +02:00
Garry Tan
f06c38d975
- testing.md (always-on): coverage gaps, flaky patterns, security enforcement - maintainability.md (always-on): dead code, DRY, stale comments - security.md (conditional): OWASP deep analysis, auth bypass, injection - performance.md (conditional): N+1 queries, bundle impact, complexity - data-migration.md (conditional): reversibility, lock duration, backfill - api-contract.md (conditional): breaking changes, versioning, error format - red-team.md (conditional): adversarial analysis, cross-cutting concerns All use standard header with JSON output schema and NO FINDINGS fallback.
61 lines
2.9 KiB
Markdown
61 lines
2.9 KiB
Markdown
# Security Specialist Review Checklist
|
|
|
|
Scope: When SCOPE_AUTH=true OR (SCOPE_BACKEND=true AND diff > 100 lines)
|
|
Output: JSON objects, one finding per line. Schema:
|
|
{"severity":"CRITICAL|INFORMATIONAL","confidence":N,"path":"file","line":N,"category":"security","summary":"...","fix":"...","fingerprint":"path:line:security","specialist":"security"}
|
|
If no findings: output `NO FINDINGS` and nothing else.
|
|
|
|
---
|
|
|
|
This checklist goes deeper than the main CRITICAL pass. The main agent already checks SQL injection, race conditions, LLM trust, and enum completeness. This specialist focuses on auth/authz patterns, cryptographic misuse, and attack surface expansion.
|
|
|
|
## Categories
|
|
|
|
### Input Validation at Trust Boundaries
|
|
- User input accepted without validation at controller/handler level
|
|
- Query parameters used directly in database queries or file paths
|
|
- Request body fields accepted without type checking or schema validation
|
|
- File uploads without type/size/content validation
|
|
- Webhook payloads processed without signature verification
|
|
|
|
### Auth & Authorization Bypass
|
|
- Endpoints missing authentication middleware (check route definitions)
|
|
- Authorization checks that default to "allow" instead of "deny"
|
|
- Role escalation paths (user can modify their own role/permissions)
|
|
- Direct object reference vulnerabilities (user A accesses user B's data by changing an ID)
|
|
- Session fixation or session hijacking opportunities
|
|
- Token/API key validation that doesn't check expiration
|
|
|
|
### Injection Vectors (beyond SQL)
|
|
- Command injection via subprocess calls with user-controlled arguments
|
|
- Template injection (Jinja2, ERB, Handlebars) with user input
|
|
- LDAP injection in directory queries
|
|
- SSRF via user-controlled URLs (fetch, redirect, webhook targets)
|
|
- Path traversal via user-controlled file paths (../../etc/passwd)
|
|
- Header injection via user-controlled values in HTTP headers
|
|
|
|
### Cryptographic Misuse
|
|
- Weak hashing algorithms (MD5, SHA1) for security-sensitive operations
|
|
- Predictable randomness (Math.random, rand()) for tokens or secrets
|
|
- Non-constant-time comparisons (==) on secrets, tokens, or digests
|
|
- Hardcoded encryption keys or IVs
|
|
- Missing salt in password hashing
|
|
|
|
### Secrets Exposure
|
|
- API keys, tokens, or passwords in source code (even in comments)
|
|
- Secrets logged in application logs or error messages
|
|
- Credentials in URLs (query parameters or basic auth in URL)
|
|
- Sensitive data in error responses returned to users
|
|
- PII stored in plaintext when encryption is expected
|
|
|
|
### XSS via Escape Hatches
|
|
- Rails: .html_safe, raw() on user-controlled data
|
|
- React: dangerouslySetInnerHTML with user content
|
|
- Vue: v-html with user content
|
|
- Django: |safe, mark_safe() on user input
|
|
- General: innerHTML assignment with unsanitized data
|
|
|
|
### Deserialization
|
|
- Deserializing untrusted data (pickle, Marshal, YAML.load, JSON.parse of executable types)
|
|
- Accepting serialized objects from user input or external APIs without schema validation
|