Skip to content

Instantly share code, notes, and snippets.

@gfnord

gfnord/SecAudit.md

Last active April 8, 2026 18:32
Show Gist options

  • Select an option

    Learn more about clone URLs
  • Save gfnord/5fe88bd060ce7acbc1699ae1a0dd58dc to your computer and use it in GitHub Desktop.

Select an option

Learn more about clone URLs
Save gfnord/5fe88bd060ce7acbc1699ae1a0dd58dc to your computer and use it in GitHub Desktop.
Download ZIP
SecAudit.md -> claude "$(cat SecAudit.md)"
Raw
SecAudit.md

Security Audit — Vibe-Coded Codebase

You are performing a comprehensive security audit of this codebase. The code was generated with AI assistance and may contain common security vulnerabilities introduced by vibe coding patterns.

Your Task

Audit the entire codebase against the 20 security parameters below. For each issue found:

  1. Identify the exact file(s) and line number(s) where the vulnerability exists
  2. Explain why it is a security risk in 1-2 sentences
  3. Fix it — provide the corrected code inline, not just a description
  4. Verify no other instances of the same pattern exist elsewhere in the codebase

Work through all 20 parameters systematically. Do not skip any. If a parameter does not apply to this codebase, state "Not applicable — [reason]".

Security Parameters

1. Hardcoded API Keys in Frontend

  • Search all client-side JS/TS files for API keys, tokens, secrets, or credentials
  • Look for: apiKey, secret, token, password, key assigned to string literals
  • Fix: Move all secrets to backend environment variables, expose only via server-side API calls

2. No Rate Limiting on Authentication Endpoints

  • Check /login, /register, /forgot-password, /reset-password, and any token endpoints
  • Fix: Add rate limiting (max 5 attempts per IP per 15 minutes) + lockout mechanism

3. SQL Injection via String Concatenation

  • Search for any query built with string concatenation or template literals containing user input
  • Look for: "SELECT" +, `SELECT ${`, query + userId, etc.
  • Fix: Replace with parameterized queries or ORM methods only

4. CORS Wildcard

  • Check all CORS configuration for origin: "*" or Access-Control-Allow-Origin: *
  • Fix: Whitelist specific allowed origins from environment variables

5. JWTs or Session Tokens in localStorage

  • Search client-side code for localStorage.setItem storing tokens, JWTs, or session data
  • Fix: Move to httpOnly, Secure, SameSite=Strict cookies set by the server

6. Weak or Hardcoded JWT Secret

  • Check JWT signing configuration for hardcoded secrets or weak values
  • Look for: secret: "secret", secret: "password", short strings, tutorial defaults
  • Fix: Generate a 256-bit random secret, load from environment variable, document rotation procedure

7. Frontend-Only Route Protection

  • Identify any admin, dashboard, or privileged routes
  • Verify each has server-side middleware enforcing authentication and authorization
  • Fix: Add auth middleware to every protected server route — React Router guards are not security

8. .env Files Committed to Git

  • Run: git log --all --full-history -- .env .env.local .env.production
  • Also check .gitignore to confirm all env files are excluded
  • Fix: If found in history, rotate every key immediately. Add .env* to .gitignore

9. Stack Traces or Internal Details in Error Responses

  • Search error handlers for responses that include error.stack, error.message, table names, file paths
  • Fix: Log full errors server-side only. Return generic {"error": "Internal server error"} to clients

10. File Upload MIME Type Validation

  • Check all file upload endpoints for validation logic
  • Extension checks alone are insufficient — validate actual MIME type server-side
  • Fix: Use a library like file-type to validate MIME type from file buffer, not filename

11. Weak Password Hashing

  • Search for any use of md5, sha1, sha256 for password hashing
  • Fix: Use bcrypt (cost factor ≥ 12) or argon2. Never implement your own hashing

12. Non-Expiring Auth Tokens

  • Check JWT and session token configuration for expiry settings
  • Look for missing expiresIn, exp, or overly long expiry (> 24h for access tokens)
  • Fix: Access tokens ≤ 15 minutes, refresh tokens ≤ 7 days with rotation on use

13. Missing Auth Middleware on Internal API Routes

  • List every single API route in the codebase
  • Verify each route that accesses user data or performs actions has auth middleware applied
  • Fix: Audit every route. Apply middleware at the router level, not just individual routes

14. Server Running as Root

  • Check Dockerfile, docker-compose, and process configuration for user settings
  • Look for missing USER directive in Dockerfiles
  • Fix: Add USER node (or equivalent non-root user) to all Dockerfiles

15. Database Port Exposed to Internet

  • Check docker-compose port mappings for database services
  • Look for 5432:5432, 3306:3306, 27017:27017 with no network restrictions
  • Fix: Remove public port mappings for databases. Use internal Docker networks only

16. IDOR on Resource Endpoints

  • Identify all endpoints that accept a resource ID parameter (/users/:id, /orders/:id, etc.)
  • Verify each checks that the authenticated user owns or has permission to access that resource
  • Fix: Add ownership validation on every resource endpoint — never trust the ID alone

17. No HTTPS Enforcement

  • Check server configuration, nginx/caddy config, and middleware for HTTP→HTTPS redirect
  • Fix: Redirect all HTTP traffic to HTTPS at the server/proxy level

18. Sessions Not Invalidated on Logout

  • Check logout handler — does it invalidate the session/token server-side?
  • Client-side cookie clearing is not sufficient
  • Fix: Maintain a token blocklist or invalidate session in database on logout

19. Unaudited npm Dependencies

  • Run npm audit in all packages (root, client, server, shared)
  • List all critical and high severity vulnerabilities found
  • Fix: Run npm audit fix where safe. Document any that require manual intervention

20. Open Redirects in Callback URLs

  • Search for any redirect logic that uses user-supplied URLs
  • Look for: res.redirect(req.query.returnTo), window.location = params.redirect, etc.
  • Fix: Validate all redirect destinations against a whitelist of allowed URLs. Never redirect to arbitrary user-supplied URLs

Output Format

For each of the 20 parameters, structure your response as:

## [N]. [Parameter Name]

**Status**: VULNERABLE / CLEAN / NOT APPLICABLE

**Location**: [file:line or "N/A"]

**Issue**: [1-2 sentence description]

**Fix**: [corrected code or commands]

After completing all 20, provide:

Summary

  • Total vulnerabilities found
  • Critical (fix before deploying): list
  • High (fix this week): list
  • Informational (good practice): list
  • Recommended deployment blockers

Important Notes

  • Do not just describe fixes — implement them
  • Check every file, not just obvious ones — AI-generated code often puts auth logic in unexpected places
  • If you find one instance of a pattern, search the entire codebase for others
  • Some vulnerabilities interact — note dependencies (e.g., fixing #5 may affect #12 and #18)
  • After all fixes, do a final pass to confirm no new issues were introduced
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment