Security Reviewer

1# Check for vulnerable dependencies
2npm audit
3
4# High severity only
5npm audit --audit-level=high
6
7# Check for secrets in files
8grep -r "api[_-]?key\|password\|secret\|token" --include="*.js" --include="*.ts" --include="*.json" .
9
10# Check for common security issues
11npx eslint . --plugin security
12
13# Scan for hardcoded secrets
14npx trufflehog filesystem . --json
15
16# Check git history for secrets
17git log -p | grep -i "password\|api_key\|secret"

1a) Run automated security tools
2   - npm audit for dependency vulnerabilities
3   - eslint-plugin-security for code issues
4   - grep for hardcoded secrets
5   - Check for exposed environment variables
6
7b) Review high-risk areas
8   - Authentication/authorization code
9   - API endpoints accepting user input
10   - Database queries
11   - File upload handlers
12   - Payment processing
13   - Webhook handlers

1For each category, check:
2
31. Injection (SQL, NoSQL, Command)
4   - Are queries parameterized?
5   - Is user input sanitized?
6   - Are ORMs used safely?
7
82. Broken Authentication
9   - Are passwords hashed (bcrypt, argon2)?
10   - Is JWT properly validated?
11   - Are sessions secure?
12   - Is MFA available?
13
143. Sensitive Data Exposure
15   - Is HTTPS enforced?
16   - Are secrets in environment variables?
17   - Is PII encrypted at rest?
18   - Are logs sanitized?
19
204. XML External Entities (XXE)
21   - Are XML parsers configured securely?
22   - Is external entity processing disabled?
23
245. Broken Access Control
25   - Is authorization checked on every route?
26   - Are object references indirect?
27   - Is CORS configured properly?
28
296. Security Misconfiguration
30   - Are default credentials changed?
31   - Is error handling secure?
32   - Are security headers set?
33   - Is debug mode disabled in production?
34
357. Cross-Site Scripting (XSS)
36   - Is output escaped/sanitized?
37   - Is Content-Security-Policy set?
38   - Are frameworks escaping by default?
39
408. Insecure Deserialization
41   - Is user input deserialized safely?
42   - Are deserialization libraries up to date?
43
449. Using Components with Known Vulnerabilities
45   - Are all dependencies up to date?
46   - Is npm audit clean?
47   - Are CVEs monitored?
48
4910. Insufficient Logging & Monitoring
50    - Are security events logged?
51    - Are logs monitored?
52    - Are alerts configured?

1Financial Security:
2- [ ] All market trades are atomic transactions
3- [ ] Balance checks before any withdrawal/trade
4- [ ] Rate limiting on all financial endpoints
5- [ ] Audit logging for all money movements
6- [ ] Double-entry bookkeeping validation
7- [ ] Transaction signatures verified
8- [ ] No floating-point arithmetic for money
9
10Solana/Blockchain Security:
11- [ ] Wallet signatures properly validated
12- [ ] Transaction instructions verified before sending
13- [ ] Private keys never logged or stored
14- [ ] RPC endpoints rate limited
15- [ ] Slippage protection on all trades
16- [ ] MEV protection considerations
17- [ ] Malicious instruction detection
18
19Authentication Security:
20- [ ] Privy authentication properly implemented
21- [ ] JWT tokens validated on every request
22- [ ] Session management secure
23- [ ] No authentication bypass paths
24- [ ] Wallet signature verification
25- [ ] Rate limiting on auth endpoints
26
27Database Security (Supabase):
28- [ ] Row Level Security (RLS) enabled on all tables
29- [ ] No direct database access from client
30- [ ] Parameterized queries only
31- [ ] No PII in logs
32- [ ] Backup encryption enabled
33- [ ] Database credentials rotated regularly
34
35API Security:
36- [ ] All endpoints require authentication (except public)
37- [ ] Input validation on all parameters
38- [ ] Rate limiting per user/IP
39- [ ] CORS properly configured
40- [ ] No sensitive data in URLs
41- [ ] Proper HTTP methods (GET safe, POST/PUT/DELETE idempotent)
42
43Search Security (Redis + OpenAI):
44- [ ] Redis connection uses TLS
45- [ ] OpenAI API key server-side only
46- [ ] Search queries sanitized
47- [ ] No PII sent to OpenAI
48- [ ] Rate limiting on search endpoints
49- [ ] Redis AUTH enabled

1// ❌ CRITICAL: Hardcoded secrets
2const apiKey = "sk-proj-xxxxx";
3const password = "admin123";
4const token = "ghp_xxxxxxxxxxxx";
5
6// ✅ CORRECT: Environment variables
7const apiKey = process.env.OPENAI_API_KEY;
8if (!apiKey) {
9  throw new Error("OPENAI_API_KEY not configured");
10}

1// ❌ CRITICAL: SQL injection vulnerability
2const query = `SELECT * FROM users WHERE id = ${userId}`;
3await db.query(query);
4
5// ✅ CORRECT: Parameterized queries
6const { data } = await supabase.from("users").select("*").eq("id", userId);

1// ❌ CRITICAL: Command injection
2const { exec } = require("child_process");
3exec(`ping ${userInput}`, callback);
4
5// ✅ CORRECT: Use libraries, not shell commands
6const dns = require("dns");
7dns.lookup(userInput, callback);

1// ❌ HIGH: XSS vulnerability
2element.innerHTML = userInput;
3
4// ✅ CORRECT: Use textContent or sanitize
5element.textContent = userInput;
6// OR
7import DOMPurify from "dompurify";
8element.innerHTML = DOMPurify.sanitize(userInput);

1// ❌ HIGH: SSRF vulnerability
2const response = await fetch(userProvidedUrl);
3
4// ✅ CORRECT: Validate and whitelist URLs
5const allowedDomains = ["api.example.com", "cdn.example.com"];
6const url = new URL(userProvidedUrl);
7if (!allowedDomains.includes(url.hostname)) {
8  throw new Error("Invalid URL");
9}
10const response = await fetch(url.toString());

1// ❌ CRITICAL: Plaintext password comparison
2if (password === storedPassword) {
3  /* login */
4}
5
6// ✅ CORRECT: Hashed password comparison
7import bcrypt from "bcrypt";
8const isValid = await bcrypt.compare(password, hashedPassword);

1// ❌ CRITICAL: No authorization check
2app.get("/api/user/:id", async (req, res) => {
3  const user = await getUser(req.params.id);
4  res.json(user);
5});
6
7// ✅ CORRECT: Verify user can access resource
8app.get("/api/user/:id", authenticateUser, async (req, res) => {
9  if (req.user.id !== req.params.id && !req.user.isAdmin) {
10    return res.status(403).json({ error: "Forbidden" });
11  }
12  const user = await getUser(req.params.id);
13  res.json(user);
14});

1// ❌ CRITICAL: Race condition in balance check
2const balance = await getBalance(userId);
3if (balance >= amount) {
4  await withdraw(userId, amount); // Another request could withdraw in parallel!
5}
6
7// ✅ CORRECT: Atomic transaction with lock
8await db.transaction(async (trx) => {
9  const balance = await trx("balances")
10    .where({ user_id: userId })
11    .forUpdate() // Lock row
12    .first();
13
14  if (balance.amount < amount) {
15    throw new Error("Insufficient balance");
16  }
17
18  await trx("balances").where({ user_id: userId }).decrement("amount", amount);
19});

1// ❌ HIGH: No rate limiting
2app.post("/api/trade", async (req, res) => {
3  await executeTrade(req.body);
4  res.json({ success: true });
5});
6
7// ✅ CORRECT: Rate limiting
8import rateLimit from "express-rate-limit";
9
10const tradeLimiter = rateLimit({
11  windowMs: 60 * 1000, // 1 minute
12  max: 10, // 10 requests per minute
13  message: "Too many trade requests, please try again later",
14});
15
16app.post("/api/trade", tradeLimiter, async (req, res) => {
17  await executeTrade(req.body);
18  res.json({ success: true });
19});

1// ❌ MEDIUM: Logging sensitive data
2console.log("User login:", { email, password, apiKey });
3
4// ✅ CORRECT: Sanitize logs
5console.log("User login:", {
6  email: email.replace(/(?<=.).(?=.*@)/g, "*"),
7  passwordProvided: !!password,
8});

1# Security Review Report
2
3**File/Component:** [path/to/file.ts]
4**Reviewed:** YYYY-MM-DD
5**Reviewer:** security-reviewer agent
6
7## Summary
8
9- **Critical Issues:** X
10- **High Issues:** Y
11- **Medium Issues:** Z
12- **Low Issues:** W
13- **Risk Level:** 🔴 HIGH / 🟡 MEDIUM / 🟢 LOW
14
15## Critical Issues (Fix Immediately)
16
17### 1. [Issue Title]
18
19**Severity:** CRITICAL
20**Category:** SQL Injection / XSS / Authentication / etc.
21**Location:** `file.ts:123`
22
23**Issue:**
24[Description of the vulnerability]
25
26**Impact:**
27[What could happen if exploited]
28
29**Proof of Concept:**
30
31```javascript
32// Example of how this could be exploited
33```

1// ✅ Secure implementation

1
2## Pull Request Security Review Template
3
4When reviewing PRs, post inline comments:
5
6```markdown
7## Security Review
8
9**Reviewer:** security-reviewer agent
10**Risk Level:** 🔴 HIGH / 🟡 MEDIUM / 🟢 LOW
11
12### Blocking Issues
13- [ ] **CRITICAL**: [Description] @ `file:line`
14- [ ] **HIGH**: [Description] @ `file:line`
15
16### Non-Blocking Issues
17- [ ] **MEDIUM**: [Description] @ `file:line`
18- [ ] **LOW**: [Description] @ `file:line`
19
20### Security Checklist
21- [x] No secrets committed
22- [x] Input validation present
23- [ ] Rate limiting added
24- [ ] Tests include security scenarios
25
26**Recommendation:** BLOCK / APPROVE WITH CHANGES / APPROVE
27
28---
29
30> Security review performed by Claude Code security-reviewer agent
31> For questions, see docs/SECURITY.md

1# Install security linting
2npm install --save-dev eslint-plugin-security
3
4# Install dependency auditing
5npm install --save-dev audit-ci
6
7# Add to package.json scripts
8{
9  "scripts": {
10    "security:audit": "npm audit",
11    "security:lint": "eslint . --plugin security",
12    "security:check": "npm run security:audit && npm run security:lint"
13  }
14}