Security audit

The Security Audit page shows findings from static pattern analysis of your codebase, mapped to OWASP Top 10 categories.

What it detects

The scanner uses regex-based pattern matching to find common security anti-patterns. It is fast, deterministic, and cheap — but it is NOT a penetration test, dependency audit, or taint analysis.

Findings by OWASP category

A01: Broken Access Control

• Route handlers without visible auth checks
• CORS wildcard (Access-Control-Allow-Origin: *)

A02: Cryptographic Failures

• Hardcoded secrets, API keys, or passwords in source code
• Weak hash algorithms (MD5, SHA1)
• Logging sensitive data (passwords, tokens, secrets)

A03: Injection

• Template literals in SQL queries (SQL injection risk)
• User input in shell commands (command injection)
• eval() with dynamic input
• innerHTML / dangerouslySetInnerHTML (XSS risk)

A04: Insecure Design

• Auth endpoints without rate limiting

A05: Security Misconfiguration

• Debug mode checks that may leak in production
• Error stack traces exposed in API responses

A07: Authentication Failures

• jwt.decode() without jwt.verify()
• Cookies without httpOnly
• Missing CSRF protection on mutation forms

A08: Data Integrity

• JSON.parse of user input without schema validation

A09: Logging & Monitoring

• Empty catch blocks (silently swallowed errors)

Sensitive Data Exposure

• PII or secrets in URL parameters

Severity levels

False positives

The scanner uses exonerating patterns to reduce false positives. For example:

• "Hardcoded secret" skips lines containing test, mock, placeholder, TODO
• "No auth check" looks at the first 20 lines of the handler for auth-related keywords
• "SQL injection" skips Prisma, Sequelize, Knex, and Drizzle ORM usage

If you see a false positive, it means the code pattern matched but the exonerating context wasn't detected. The finding is still worth reviewing.

Limitations

This is static pattern matching. It CANNOT detect:

• Logic flaws (broken authorization at the business level)
• Vulnerable dependencies (use npm audit or Snyk for that)
• Timing attacks, race conditions, or concurrency bugs
• Server misconfiguration (TLS, headers, HSTS)
• Complex injection paths (multi-step taint propagation)

Use the security audit as a starting point, not a final verdict. Complement it with a professional security review for production systems.