Security Audit

2. Broken Authentication

Check Points:

• Passwords hashed with bcrypt/argon2 (not MD5/SHA1)
• Session tokens are random and secure
• Login rate limiting enabled
• Password complexity enforced
• Multi-factor authentication available

Secure Password Handling:

from passlib.context import CryptContext

pwd_context = CryptContext(schemes=["bcrypt"], deprecated="auto")

def hash_password(password: str) -> str:
    return pwd_context.hash(password)

def verify_password(plain: str, hashed: str) -> bool:
    return pwd_context.verify(plain, hashed)

3. Sensitive Data Exposure

Check Points:

• Secrets in environment variables, not code
• HTTPS enforced in production
• Sensitive data encrypted at rest
• API responses don't leak internal errors

Audit Commands:

# Find hardcoded secrets
grep -r "password\s*=" --include="*.py" backend/
grep -r "secret\s*=" --include="*.py" backend/
grep -r "api_key\s*=" --include="*.py" backend/

4. XML External Entities (XXE)

Check Points:

• XML parsing disabled or secured
• Use JSON instead of XML where possible

5. Broken Access Control

Check Points:

• All sensitive endpoints require authentication
• Role-based access control implemented
• Users can only access their own data
• Admin functions protected

Secure Endpoint Pattern:

from fastapi import Depends, HTTPException, status
from app.core.security import get_current_user, get_current_admin

@router.get("/admin/users")
def list_users(admin: User = Depends(get_current_admin)):
    """Only admins can list all users."""
    return user_service.get_all()

@router.get("/users/{user_id}")
def get_user(user_id: int, current_user: User = Depends(get_current_user)):
    """Users can only access their own data."""
    if current_user.id != user_id and not current_user.is_admin:
        raise HTTPException(status_code=403, detail="Access denied")
    return user_service.get(user_id)

6. Security Misconfiguration

Check Points:

• Debug mode disabled in production
• Default credentials changed
• Unnecessary features disabled
• Security headers configured
• Error messages don't reveal system info

Security Headers:

async def add_security_headers(request: Request, call_next):
    response = await call_next(request)
    response.headers["X-Content-Type-Options"] = "nosniff"
    response.headers["X-Frame-Options"] = "DENY"
    response.headers["X-XSS-Protection"] = "1; mode=block"
    response.headers["Strict-Transport-Security"] = "max-age=31536000"
    response.headers["Content-Security-Policy"] = "default-src 'self'"
    return response

7. Cross-Site Scripting (XSS)

Check Points:

• User input sanitized before display
• Content-Security-Policy header set
• React/Next.js auto-escaping used

Frontend Protection:

• Let React auto-escape by using {userInput} syntax
• If HTML rendering needed, use DOMPurify library to sanitize
• Always validate and sanitize user input on server side

8. Insecure Deserialization

Check Points:

• Avoid unsafe serialization with untrusted data
• Validate JSON schema before processing
• Use Pydantic for input validation
• Prefer JSON over binary serialization formats

9. Using Components with Known Vulnerabilities

Check Points:

• Dependencies regularly updated
• Security advisories monitored
• Automated vulnerability scanning

Audit Commands:

# Python dependencies
pip-audit
safety check

# npm dependencies
npm audit

10. Insufficient Logging & Monitoring

Check Points:

• Authentication events logged
• Failed access attempts logged
• Logs don't contain sensitive data
• Alerting configured for anomalies

CORS Configuration

Secure CORS Setup

from fastapi.middleware.cors import CORSMiddleware

# Production: Specific origins only
ALLOWED_ORIGINS = [
    "https://themoon.example.com",
    "https://admin.themoon.example.com",
]

# Development: Add localhost
if settings.DEBUG:
    ALLOWED_ORIGINS.extend([
        "http://localhost:3000",
        "http://localhost:3500",
    ])

app.add_middleware(
    CORSMiddleware,
    allow_origins=ALLOWED_ORIGINS,  # Never use ["*"] in production
    allow_credentials=True,
    allow_methods=["GET", "POST", "PUT", "PATCH", "DELETE"],
    allow_headers=["Authorization", "Content-Type"],
)

Input Validation

Pydantic Validation

from pydantic import BaseModel, Field, field_validator
import re

class UserCreate(BaseModel):
    email: str = Field(..., max_length=255)
    password: str = Field(..., min_length=8, max_length=100)
    name: str = Field(..., min_length=1, max_length=100)

    @field_validator("email")
    @classmethod
    def validate_email(cls, v: str) -> str:
        pattern = r"^[a-zA-Z0-9_.+-]+@[a-zA-Z0-9-]+\.[a-zA-Z0-9-.]+$"
        if not re.match(pattern, v):
            raise ValueError("Invalid email format")
        return v.lower()

File Upload Validation

from fastapi import UploadFile, HTTPException
import magic

ALLOWED_TYPES = {"image/jpeg", "image/png", "application/pdf"}
MAX_SIZE = 10 * 1024 * 1024  # 10MB

async def validate_file(file: UploadFile) -> None:
    content = await file.read()
    if len(content) > MAX_SIZE:
        raise HTTPException(400, "File too large")

    mime_type = magic.from_buffer(content, mime=True)
    if mime_type not in ALLOWED_TYPES:
        raise HTTPException(400, f"File type {mime_type} not allowed")

    await file.seek(0)

Rate Limiting

from slowapi import Limiter
from slowapi.util import get_remote_address

limiter = Limiter(key_func=get_remote_address)

@router.post("/auth/login")
@limiter.limit("5/minute")
def login(request: Request, credentials: LoginRequest):
    pass

@router.post("/upload")
@limiter.limit("10/hour")
def upload(request: Request, file: UploadFile):
    pass

Security Audit Report Template

## Security Audit Report
**Date**: YYYY-MM-DD
**Auditor**: Agent 6

### Summary
- Critical: X | High: X | Medium: X | Low: X

### Findings
#### [CRITICAL] Issue Title
- Location: file:line
- Risk: Description
- Recommendation: Fix approach
- Status: Open/Fixed

Additional Resources

Reference Files

• references/owasp-checklist.md - Complete OWASP Top 10 checklist
• references/secure-coding.md - Secure coding patterns

Quick Reference