Security Audit

Files (4)

• BEST_PRACTICES.md
• README.md
• SKILL.md
• quick-audit.sh · scripts/

SKILL.md (first lines)

# Security Audit Skill

This skill provides automated security auditing capabilities for detecting secrets, tokens, API keys, and other security vulnerabilities in your codebase.

## Overview

The Security Audit Skill helps you:
- Detect hardcoded secrets and API keys
- Verify secure token transmission
- Check for logging of sensitive information
- Validate environment variable usage
- Ensure compliance with security best practices

## Usage

### Quick Audit

Run a quick security audit on your repository:

```bash
./skills/security-audit/scripts/quick-audit.sh
```

### Full Audit

Run a comprehensive security audit with detailed reporting:

```bash
./skills/security-audit/scripts/full-audit.sh
```

### Token Transmission Audit

Specifically audit service token transmission:

```bash
./skills/security-audit/scripts/audit-token-transmission.sh
```

### Pre-commit Hook

Install as a pre-commit hook to prevent secrets from being committed:

```bash
./skills/security-audit/scripts/install-pre-commit-hook.sh
```

## What It Checks

### 1. Hardcoded Secrets Detection

Scans for:
- API keys (AWS, Google Cloud, Stripe, etc.)
- Database passwords
- Private keys
- OAuth tokens
- JWT secrets

### 2. Token Transmission Security

Verifies:
- Tokens only in HTTP headers, never in URLs
- No query parameter leakage
- Proper HTTPS usage
- No token logging

### 3. Environment Variable Security

Checks:
- Secrets read from environment variables
- No hardcoded credentials
- Proper .env file usage
- .gitignore includes .env files

### 4. Logging Security

Detects:
- Logging of sensitive tokens
- Password logging
- API key exposure in logs
- Debug output containing secrets

### 5. Error Handling

Validates:
- Generic error messages
- No information leakage
- Proper error sanitization

## Configuration

Create a `.security-audit.yml` file in your repository root:

```yaml
# Security Audit Configuration
version: 1.0

# Patterns to detect (regex)
secret_patterns:
  - name: "AWS Access Key"
    pattern: "AKIA[0-9A-Z]{16}"
    severity: "critical"
  
  - name: "Generic API Key"
    pattern: "api[_-]?key['\"]?\\s*[:=]\\s*['\"][a-zA-Z0-9]{32,}['\"]"
    severity: "high"
  
  - name: "Private Key"
    pattern: "-----BEGIN (RSA |EC |OPENSSH )?PRIVATE KEY-----"
    severity: "critical"

# Files to exclude from scanning
exclude_paths:
  - "node_modules/"
  - ".git/"
  - "*.test.js"
  - "*.test.ts"
  - "test/fixtures/"

From haitaopanhq/.github, Apache-2.0.

More from haitaopanhq/.github