# Full security scan
/codebase-quality security

# Specific scans
/codebase-quality secrets
/codebase-quality deps
/codebase-quality injection

# As first step in audit
Skill("codebase-quality:security")

# After security passes, chain to code quality
Skill("codebase-quality:code-quality")

# Using git-secrets
git secrets --scan

# Using trufflehog
trufflehog git file://. --only-verified

# Manual regex patterns
grep -rn "sk-[a-zA-Z0-9]" .              # OpenAI
grep -rn "AKIA[A-Z0-9]{16}" .            # AWS
grep -rn "-----BEGIN.*PRIVATE KEY" .     # Private keys

npm audit
npm audit --audit-level=high  # Only high/critical

pip-audit                     # Python packages
safety check                  # Alternative scanner

# Auto-fix where possible
npm audit fix

# For breaking changes
npm audit fix --force  # Use with caution

# Python
pip install --upgrade <package>

# BAD - vulnerable
query = f"SELECT * FROM users WHERE id = {user_id}"

# GOOD - parameterized
query = "SELECT * FROM users WHERE id = %s"
cursor.execute(query, (user_id,))

// BAD - vulnerable
element.innerHTML = userInput;

// GOOD - sanitized
element.textContent = userInput;
// or use DOMPurify
element.innerHTML = DOMPurify.sanitize(userInput);

# BAD - vulnerable
os.system(f"ls {user_path}")

# GOOD - safe
subprocess.run(["ls", user_path], shell=False)

# Every API endpoint should have auth
@app.route("/api/sensitive")
@require_auth  # ← Required
def sensitive_endpoint():
    pass

# Security Scan Report - 2025-12-19

## Summary
- **Scan Status**: ❌ FAILED (2 critical issues)
- **Files Scanned**: 234
- **Critical**: 2
- **High**: 1
- **Moderate**: 3

## CRITICAL Issues (Block Merge)

### C001: Exposed API Key
- **File**: `my-project-backend/config.py:45`
- **Type**: OpenAI API Key
- **Pattern**: `sk-proj-xxxxx...`
- **Action Required**:
  1. Remove from code
  2. Rotate key in OpenAI dashboard
  3. Use OPENAI_API_KEY environment variable

### C002: Exposed Database Credentials
- **File**: `.env.example:12` (committed to git)
- **Type**: PostgreSQL connection string
- **Action Required**:
  1. Remove from git history
  2. Rotate database password
  3. Never commit .env files

## HIGH Issues (Block Merge)

### H001: Known Vulnerability in lodash
- **Package**: [email protected]
- **CVE**: CVE-2021-23337
- **Severity**: High (Prototype Pollution)
- **Fix**: `npm install [email protected]`

## MODERATE Issues (Warn)

### M001: npm audit moderate vulnerability
- **Package**: [email protected] (transitive)
- **Via**: css-select → svgo
- **Fix**: Update svgo to latest

## Passed Checks

✅ No hardcoded passwords found
✅ No SQL injection patterns detected
✅ No XSS vulnerabilities in React components
✅ All API endpoints have authentication

CRITICAL issue found
    ↓
1. STOP all other checks
2. Generate security report
3. Notify immediately
4. DO NOT proceed to code-quality
5. Require manual remediation

HIGH issue found
    ↓
1. Add to security report
2. Block merge if in pre-merge mode
3. Continue scan for other issues
4. Require fix before merge

MODERATE/LOW issue found
    ↓
1. Add to security report
2. Log warning
3. Continue to code-quality
4. Track for future fix

codebase-quality:security  ← YOU ARE HERE
    ↓
1. Scan for secrets
2. Audit dependencies
3. Check injection patterns
4. Verify auth on endpoints
    ↓
If CRITICAL/HIGH: STOP, report, require fix
If MODERATE/LOW: Continue with warnings
    ↓
codebase-quality:code-quality

/codebase-quality pre-merge
    ↓
security scan:
- CRITICAL → Block merge, alert
- HIGH → Block merge
- MODERATE → Warn, allow merge
- LOW → Info, allow merge

# Continue to code quality
Skill("codebase-quality:code-quality")

# DO NOT continue
# Report and require human remediation
# Only proceed after issues resolved

# 1. Immediately rotate the credential

# 2. Remove from git history (if not pushed)
git filter-branch --force --index-filter \
  'git rm --cached --ignore-unmatch path/to/file' \
  --prune-empty --tag-name-filter cat -- --all

# 3. If already pushed, notify security team
# Consider repository compromise procedures