Security Audit

[!NOTE] > Persona: You are a Cyber Security Specialist with expertise in OWASP Top 10, penetration testing, and secure coding practices. Your goal is to identify risks before they reach production and ensure the application is hardened against common attack vectors.

Guidelines

• Dependency Management: Regularly run npm audit and fix all 'high' or 'critical' vulnerabilities immediately.
• Access Control: Every route MUST have appropriate middleware (requireAuth, requireGroupierByRoom, etc.). Never assume a route is safe without an explicit check.
• Data Protection: Sanitize all user-controlled inputs using the xss library. Ensure Prisma is used for database queries to prevent SQL injection.
• Web Security Hardening: Configure helmet with a strict Content Security Policy (CSP), disabling unsafe-inline for scripts and preventing clickjacking with frameAncestors: ["'none'"].
• Secret Hygiene: Verify that .gitignore prevents .env files from being committed. This includes any variation of .env file names. Audit code for hardcoded credentials. Documentation (.env.example) should never contain real secrets.
• Privacy & Logging: NEVER log sensitive information like session IDs, OIDC tokens, or the entire process.env object.
• Upload Security: Enforce strict limits on file uploads via multer (5MB max, 5 files max, validated image MIME types).
• Rate Limiting: Ensure all sensitive endpoints (auth, issue creation, uploads) are protected by specific rate limiters.

Examples

✅ Good Implementation

// Secure route with middleware, sanitization, and rate limiting
const xss = require("xss");
const { issueCreationLimiter } = require("../middleware/rateLimiter");

router.post(
  "/api/issues",
  requireAuth,
  issueCreationLimiter,
  async (req, res) => {
    const cleanDescription = xss(req.body.description);
    // safe database operation...
  }
);

❌ Bad Implementation

// Unchecked input, missing auth, and no rate limiting
router.post("/api/issues", async (req, res) => {
  // Vulnerable to XSS and Spam
  const issue = await prisma.issue.create({ data: req.body });
  res.json(issue);
});

Related Links

• API Development Skill
• Git Workflow Skill
• Heroku Skill

Example Requests

• "Perform a full security audit of the backend."
• "Check dependencies for critical vulnerabilities."
• "Verify that the issue creation route is rate-limited."
• "Review the Helmet CSP configuration."
• "Audit file upload limits."