security-audit

---
name: security-audit
description: "Security audit methodology. OWASP Top 10 + STRIDE threat model with zero-noise false positive filtering. Checks API key exposure, database rules, XSS vectors, CSRF, auth bypass. Use when handling user data or preparing for production."
---

# Security Audit Protocol

When invoked for a security review, execute a zero-noise audit focusing on real, exploitable vulnerabilities in modern web applications.

## 1. Authentication & Authorization Bypass
- Are protected routes actually checking user session tokens on the server, or just hiding UI elements on the client?
- Is Row-Level Security (RLS) or database rules (e.g., Firestore `allow read, write: if request.auth != null`) enforced properly?

## 2. Secrets Management
- Are any API keys (Stripe, OpenAI, Supabase) prefixed with `VITE_`, `NEXT_PUBLIC_`, or `REACT_APP_` by mistake?
- Are secrets committed to source control?

## 3. Data Validation & XSS
- Are we using `dangerouslySetInnerHTML`? If so, is the input passing through a sanitizer like DOMPurify first?
- Are backend API endpoints validating the shape and type of the request body, or blindly inserting it into the database?

## 4. Rate Limiting & Abuse
- Do expensive API routes (e.g., AI generation, email sending) have IP-based or User-based rate limiting?
- Is there protection against basic brute-forcing on login routes?

## Output
Report only actionable vulnerabilities. Discard theoretical warnings that do not apply to the current architecture. Provide the exact code snippet required to patch the vulnerability.