Git Github Security Review

// Bad: Missing authorization check
app.get('/user/:id', async (req, res) => {
  const user = await User.findById(req.params.id);
  res.json(user);
});

// Good: Verify ownership
app.get('/user/:id', authenticate, async (req, res) => {
  if (req.user.id !== req.params.id && !req.user.isAdmin) {
    return res.status(403).json({ error: 'Forbidden' });
  }
  const user = await User.findById(req.params.id);
  res.json(user);
});

A02: Cryptographic Failures

// Bad: Weak hashing
const hash = crypto.createHash('md5').update(password).digest('hex');

// Good: Strong hashing with salt
const hash = await bcrypt.hash(password, 12);

A03: Injection

// Bad: SQL injection
const query = `SELECT * FROM users WHERE id = ${userId}`;

// Good: Parameterized query
const query = 'SELECT * FROM users WHERE id = $1';
const result = await db.query(query, [userId]);

// Bad: Command injection
exec(`ls ${userInput}`);

// Good: Avoid shell, use arrays
execFile('ls', [userInput]);

A04: Insecure Design

A05: Security Misconfiguration

// Security headers
app.use(helmet());
app.use(helmet.contentSecurityPolicy({
  directives: {
    defaultSrc: ["'self'"],
    scriptSrc: ["'self'"],
    styleSrc: ["'self'", "'unsafe-inline'"],
  }
}));

A06: Vulnerable Components

# Check for vulnerabilities
npm audit
# or
yarn audit
# or
snyk test

A07: Authentication Failures

// Bad: Weak session
req.session.userId = user.id;

// Good: Regenerate session on auth
req.session.regenerate((err) => {
  req.session.userId = user.id;
  req.session.isAuthenticated = true;
});

A08: Software and Data Integrity

// Bad: Unsafe deserialization
const data = JSON.parse(untrustedInput);
eval(data.code);

// Good: Validate structure
const data = JSON.parse(untrustedInput);
if (!isValidSchema(data)) {
  throw new Error('Invalid data format');
}

A09: Security Logging and Monitoring

// Good: Security event logging
logger.security({
  event: 'AUTH_FAILURE',
  userId: attemptedUserId,
  ip: req.ip,
  userAgent: req.get('user-agent'),
  timestamp: new Date().toISOString()
});

A10: Server-Side Request Forgery (SSRF)

// Bad: Unvalidated URL
const response = await fetch(userProvidedUrl);

// Good: Validate URL
const allowedHosts = ['api.example.com', 'cdn.example.com'];
const url = new URL(userProvidedUrl);
if (!allowedHosts.includes(url.host)) {
  throw new Error('Host not allowed');
}
const response = await fetch(url);

Additional Security Checks

Secrets and Credentials

• No hardcoded passwords/API keys
• Environment variables for secrets
• Secrets not in version control
• Secrets not logged

# Scan for secrets
git secrets --scan
# or
trufflehog git file://.
# or
gitleaks detect

Input Validation

// Good: Validate and sanitize
const schema = Joi.object({
  email: Joi.string().email().required(),
  age: Joi.number().integer().min(0).max(150),
  name: Joi.string().alphanum().max(100)
});

const { error, value } = schema.validate(input);
if (error) {
  throw new ValidationError(error.details);
}

XSS Prevention

// Bad: Direct HTML insertion
element.innerHTML = userInput;

// Good: Text content or sanitize
element.textContent = userInput;
// or
element.innerHTML = DOMPurify.sanitize(userInput);

CSRF Protection

// Express CSRF protection
app.use(csrf());
app.use((req, res, next) => {
  res.locals.csrfToken = req.csrfToken();
  next();
});

Security Review Report Template

# Security Review: [Feature/Component]

## Risk Assessment
- **Overall Risk**: [Critical / High / Medium / Low]
- **Attack Surface**: [Description]
- **Data Sensitivity**: [High / Medium / Low]

## Vulnerabilities Found

### Critical
| # | Type | Location | CVSS | Description |
|---|------|----------|------|-------------|
| 1 | A03: Injection | file:line | 9.8 | SQL injection |

### High
[Table of high-severity issues]

### Medium
[Table of medium-severity issues]

### Low
[Table of low-severity issues]

## Recommendations

### Immediate Actions (Critical/High)
1. [Action item with specific fix]

### Short-term (Medium)
1. [Action item]

### Long-term (Low/Improvements)
1. [Action item]

## Compliance Notes
- GDPR: [Status]
- PCI-DSS: [Status]
- HIPAA: [Status] (if applicable)

## Tools Used
- Static analysis: [tool]
- Dependency scan: [tool]
- Secret scan: [tool]

Severity Classification

Deliverables

For: $ARGUMENTS

Provide:

1. OWASP Top 10 compliance assessment
2. Vulnerability list with severity ratings
3. Specific code locations and fixes
4. Security recommendations
5. Risk summary and prioritized remediation plan