Security Review

# Node.js / npm
npm audit                    # Check for known vulnerabilities
npm audit --audit-level=high # Only show high/critical severity
npm audit fix                # Auto-fix where possible (minor/patch updates)

# Python / pip
pip audit                    # Requires pip-audit package
safety check                 # Alternative: safety package

# Rust / cargo
cargo audit                  # Requires cargo-audit

# General (works with any ecosystem)
# Use Snyk, Dependabot, or Trivy for cross-ecosystem scanning

npm install -D eslint-plugin-security eslint-plugin-sonarjs \
  typescript-eslint eslint-plugin-react eslint-plugin-react-hooks \
  eslint-config-prettier eslint-plugin-prettier

import js from '@eslint/js';
import nextPlugin from '@next/eslint-plugin-next';
import tseslint from 'typescript-eslint';
import security from 'eslint-plugin-security';
import sonarjs from 'eslint-plugin-sonarjs';
import reactHooks from 'eslint-plugin-react-hooks';
import prettierConfig from 'eslint-config-prettier';
import prettier from 'eslint-plugin-prettier';

export default tseslint.config(
  js.configs.recommended,
  ...tseslint.configs.recommended,
  security.configs.recommended,
  sonarjs.configs.recommended,
  prettierConfig,
  {
    plugins: {
      '@next/next': nextPlugin,
      'react-hooks': reactHooks,
      prettier,
    },
    rules: {
      // TypeScript quality
      '@typescript-eslint/no-explicit-any': 'error',
      '@typescript-eslint/no-unused-vars': ['error', { argsIgnorePattern: '^_' }],
      '@typescript-eslint/consistent-type-imports': ['error', { prefer: 'type-imports' }],
      '@typescript-eslint/explicit-function-return-type': ['warn', {
        allowExpressions: true,
        allowTypedFunctionExpressions: true,
      }],

      // Naming conventions
      '@typescript-eslint/naming-convention': ['error',
        { selector: 'variable', format: ['camelCase', 'UPPER_CASE', 'PascalCase'] },
        { selector: 'function', format: ['camelCase', 'PascalCase'] },
        { selector: 'typeLike', format: ['PascalCase'] },
        { selector: 'enumMember', format: ['UPPER_CASE'] },
      ],

      // Complexity limits
      'max-lines': ['warn', { max: 500, skipBlankLines: true, skipComments: true }],
      'max-depth': ['warn', 4],
      'complexity': ['warn', 20],

      // React hooks
      'react-hooks/rules-of-hooks': 'error',
      'react-hooks/exhaustive-deps': 'warn',

      // Code quality
      'no-console': ['warn', { allow: ['warn', 'error'] }],
      'prefer-const': 'error',

      // Formatting
      'prettier/prettier': 'error',
    },
  },
);

HEADERS & CORS
  □ Content-Security-Policy header is set (blocks XSS, inline scripts)
  □ X-Content-Type-Options: nosniff
  □ X-Frame-Options: DENY (or SAMEORIGIN if iframes are needed)
  □ Strict-Transport-Security header (HSTS)
  □ CORS allows only specific origins, not wildcard (*)

COOKIES
  □ Session cookies have HttpOnly flag (not accessible via JavaScript)
  □ Session cookies have Secure flag (HTTPS only)
  □ SameSite=Strict or SameSite=Lax on session cookies
  □ Cookie domain is scoped correctly (not too broad)

ENVIRONMENT
  □ Debug mode is OFF in production
  □ Stack traces are hidden from users in production
  □ Database connections use TLS/SSL
  □ Admin/management endpoints are not publicly accessible
  □ Rate limiting is configured on auth and API endpoints

DOCKER / INFRASTRUCTURE
  □ Container runs as non-root user
  □ Base image is recent and not EOL
  □ Only necessary ports are exposed
  □ Health check endpoint exists and is monitored
  □ Secrets are injected at runtime, not baked into image

STEP 1: DEPENDENCY AUDIT
  Run: npm audit (or equivalent for the project's package manager)
  Report: List any high/critical vulnerabilities with package name and CVE

STEP 2: STATIC ANALYSIS CHECK
  Run the full ESLint config (not just security plugins):
    npm run lint
  Look for violations in these categories:
    - Naming convention errors (renamed variables that don't match their type)
    - Complexity warnings (functions over 20 cyclomatic complexity)
    - Explicit return type warnings on exported functions (data leaks)
    - React hooks exhaustive-deps warnings (stale auth state risk)
    - Security plugin findings (eval, dynamic require, child_process)
  If the project only has eslint-plugin-security and eslint-plugin-sonarjs,
  recommend adding the full quality config (see Layer 2 on this page).

STEP 3: SECRETS SCAN
  Search codebase for hardcoded secrets:
    - grep -r "API_KEY|SECRET|PASSWORD|TOKEN" --include="*.ts" --include="*.js"
    - Check .env files exist in .gitignore
    - Check no .env files are committed (git log --all --diff-filter=A -- "*.env")
    - Check client-side code doesn't reference server-only env vars

STEP 4: AUTH REVIEW
  Find authentication code (search for: auth, login, session, jwt, bcrypt)
    - Verify password hashing algorithm (must be bcrypt/argon2/scrypt)
    - Verify session/JWT configuration (expiry, httpOnly, secure)
    - Verify protected routes have auth middleware
    - Check for role-based access control on admin endpoints

STEP 5: INPUT VALIDATION REVIEW
  Find API route handlers (search for: route.ts, api/, POST, PUT, PATCH)
    - Verify every endpoint validates input with a schema library
    - Verify no raw SQL queries (parameterized queries or ORM only)
    - Check for any use of innerHTML or dangerouslySetInnerHTML
    - Verify file upload handling (if applicable)

STEP 6: CONFIGURATION REVIEW
  Check these files:
    - next.config.ts / vite.config.ts — security headers configured?
    - middleware.ts — auth checks on protected routes?
    - docker-compose.yml / Dockerfile — non-root user? minimal ports?
    - .env.example — are required secrets documented?

STEP 7: PRODUCE REPORT
  Format:
    ## Security Review Report — {Project Name}
    Date: {date}
    Reviewer: AI Security Review

    ### Critical Findings
    (Issues that must be fixed immediately — active vulnerabilities)

    ### High Findings  
    (Issues that should be fixed soon — potential attack vectors)

    ### Medium Findings
    (Issues to address in next sprint — defense-in-depth improvements)

    ### Low Findings
    (Minor improvements — best practices not yet followed)

    ### Informational
    (Observations and recommendations for future consideration)

    ### Summary
    Total findings: X critical, X high, X medium, X low, X info