iblai-security-owasp-audit

# /iblai-security-owasp-audit

Run a systematic source-code audit against the OWASP Top 10 (2021).
Ship concrete findings with file/line references and remediation.

Do NOT write exploits. Every finding ships with a fix.

## Step 0: Scope the Audit

1. Identify language, framework, and architecture.
2. Map entry points — routes, API handlers, form processors.
3. Trace data flows — user input -> processing -> storage -> output.
4. Locate authentication and authorization boundaries.

Multi-tenant B2B SaaS (the typical ibl.ai shape) makes A01 and permission-bypass paths the highest-leverage targets — sweep those first.

## Audit Checklist

Walk each category. Grep for known sinks, then read flagged files to confirm.

### A01: Broken Access Control

- Endpoints/routes missing authorization checks
- IDOR — user-controlled IDs without ownership verification
- Missing CSRF protections on state-changing requests
- Role checks enforced only on the frontend, not server-side
- Grep for: direct object references, missing auth middleware, user ID pulled from request params

### A02: Cryptographic Failures

- Hardcoded secrets, API keys, or passwords in source
- Weak hashing (MD5, SHA1 for passwords instead of bcrypt/argon2/scrypt)
- Sensitive data in logs, URLs, or localStorage
- Missing encryption at rest or in transit
- Grep for: `password`, `secret`, `api_key`, `private_key`, `MD5`, `SHA1`, `base64`

### A03: Injection

- **SQL injection:** raw queries with string concatenation, missing parameterized queries
- **NoSQL injection:** unsanitized user input in MongoDB/Convex queries
- **Command injection:** `exec()`, `spawn()`, `system()` with user input
- **XSS:** unescaped user input in HTML, `dangerouslySetInnerHTML`, `v-html`
- **Template injection:** user input in template literals
- Grep for: `exec(`, `eval(`, `innerHTML`, `dangerouslySetInnerHTML`, `$where`, raw SQL strings

### A04: Insecure Design

- Authentication flows with logic flaws
- Missing rate limiting on sensitive endpoints (login, password reset, API)
- Business-logic constraints enforced only client-side

### A05: Security Misconfiguration

- Debug mode enabled in production configs
- Overly permissive CORS (`Access-Control-Allow-Origin: *`)
- Missing HTTP security headers (CSP, HSTS, X-Frame-Options, X-Content-Type-Options)
- Default credentials or configs shipped
- Verbose error messages leaking stack traces or internals

### A06: Vulnerable Components

- Run `npm audit` (Node), `pip audit` (Python), or equivalent
- Check lock files for known-vulnerable versions
- Flag dependencies with critical CVEs

### A07: Authentication Failures

- Weak password policies
- Session management issues (missing secure/httpOnly flags, no expiry, no rotation)
- Missing rate limiting on login (credential-stuffing risk)
- Broken password reset flows

### A08: Data Integrity Failures

- Unsafe deserialization of user input
- Missing integrity checks on CI/CD pipelines
- No lockfile integrity verification (SRI hashes)

### A09: Logging & Monitoring Failures

- Auth events not logged (login, failure, privilege changes)
- Sensitive data written to logs (passwords, tokens, PII)
- No alerting on suspicious patterns

### A10: SSRF

- User-controlled URLs passed to server-side HTTP requests
- Missing URL validation and allowlisting
- Grep for: `fetch(`, `axios(`, `http.get(`, `urllib`, `requests.get(` with user input

## Report Format

For each finding:

```markdown
#### [SEVERITY] A0X: [Title]
**File:** `path/to/file.ts:42`
**CWE:** CWE-XXX

**Description:** [What the vulnerability is and why it matters]

**Vulnerable Code:**
[code snippet]

**Remediation:**
[Fixed code snippet with explanation]
```

Wrap in an executive summary:

```markdown
# Security Audit Report
## Project: [name]
## Stack: [technologies]
## Date: [date]

### Summary
- Total findings: X
- Critical: X | High: X | Medium: X | Low: X | Info: X

### Findings
[Individual findings as above]

### Prioritized Remediation Plan
1. [Critical fixes — immediate]
2. [High fixes — this week]
3. [Medium/Low — scheduled]
```

## Boundaries

- Only audit code the user provides or points you to.
- Always include remediation — fixes, not exploits.
- Flag low-confidence findings as "Potential" rather than confirmed.
- If the codebase is too large for a full audit, prioritize auth, input handling, and data-access layers.
- Refuse requests to insert backdoors or weaken security controls.

## References

OWASP Top 10 (2021), OWASP Code Review Guide, CWE Top 25