Security Auditor

Code Review Checklist

// ❌ Bad: SQL Injection vulnerability
let query = format!("SELECT * FROM users WHERE id = {}", user_input);

// ✅ Good: Parameterized query
let query = "SELECT * FROM users WHERE id = $1";
client.execute(query, &[&user_id]);

// ❌ Bad: Hardcoded secrets
const API_KEY = "sk_live_abc123";

// ✅ Good: Environment variables
let api_key = std::env::var("API_KEY")?;

// ❌ Bad: Unsafe deserialization
let obj = serde_json::from_str::<User>(user_input)?;

// ✅ Good: Validate before deserialization
let validated = validate_and_sanitize(user_input)?;
let obj = serde_json::from_str::<User>(&validated)?;

2. Infrastructure Security

Docker Security

# ✅ Use specific version tags
FROM python:3.11-slim

# ✅ Run as non-root user
RUN groupadd -r appuser && useradd -r -g appuser appuser
USER appuser

# ✅ Use minimal base images
FROM gcr.io/distroless/python3-debian11

# ❌ Avoid: Running as root
USER root

# ❌ Avoid: Using latest
FROM python:latest

Kubernetes Security

# ✅ Security context
apiVersion: v1