Claude Code command For developers

Audit (command)

Contributed by Rohit Ghumare (awesome-claude-code-toolkit)

Source: original file · added 2026-10-29

Perform a security audit of the codebase covering common vulnerability categories.

Steps

1. Dependency Vulnerabilities

  • Run the package manager's audit: npm audit, pip audit, cargo audit, govulncheck ./....
  • List critical and high severity vulnerabilities.
  • For each, determine if the vulnerable code path is actually reachable in this project.
  • Recommend specific version upgrades or patches.

2. Secrets Scan

  • Search for hardcoded secrets, API keys, tokens, and passwords:
    • Patterns: password\s*=, api[_-]?key, secret, token, Bearer , base64-encoded strings.
    • Files: .env files committed to git, config files, source code.
  • Check .gitignore for proper exclusion of sensitive files.
  • Verify environment variables are used for all secrets.

3. OWASP Top 10 Check

  • Injection: SQL injection, command injection, XSS. Search for string concatenation in queries, eval(), innerHTML.
  • Broken Auth: Weak password policies, missing rate limiting, session fixation.
  • Sensitive Data Exposure: Unencrypted data at rest/transit, verbose error messages, logs containing PII.
  • Broken Access Control: Missing authorization checks, IDOR vulnerabilities, privilege escalation paths.
  • Security Misconfiguration: Default credentials, unnecessary features enabled, CORS wildcards.

4. Input Validation

  • Verify all user inputs are validated before processing.
  • Check for proper type coercion and boundary checking.
  • Ensure file uploads have type, size, and name validation.
  • Verify URL and redirect validation prevents open redirects.

5. Authentication and Authorization Review

  • Check password hashing (bcrypt/argon2, not MD5/SHA1).
  • Verify JWT token expiration and rotation.
  • Check for proper CSRF protection.
  • Verify role-based access control at the API layer, not just the UI.

6. Report

Produce a findings report organized by severity (Critical, High, Medium, Low, Info) with:

  • Finding description.
  • Affected file and line.
  • Recommended fix.
  • Reference (CWE number or OWASP category).

Rules

  • Prioritize findings by exploitability and impact, not just theoretical risk.
  • Include proof-of-concept for critical findings when safe to do so.
  • Do not just list tools to run. Actually analyze the output and provide actionable recommendations.
  • Check both the application code and infrastructure configuration (Dockerfiles, CI configs, cloud configs).
Original source file (unmodified)

Perform a security audit of the codebase covering common vulnerability categories. ## Steps ### 1. Dependency Vulnerabilities - Run the package manager's audit: `npm audit`, `pip audit`, `cargo audit`, `govulncheck ./...`. - List critical and high severity vulnerabilities. - For each, determine if the vulnerable code path is actually reachable in this project. - Recommend specific version upgrades or patches. ### 2. Secrets Scan - Search for hardcoded secrets, API keys, tokens, and passwords: - Patterns: `password\s*=`, `api[_-]?key`, `secret`, `token`, `Bearer `, base64-encoded strings. - Files: `.env` files committed to git, config files, source code. - Check `.gitignore` for proper exclusion of sensitive files. - Verify environment variables are used for all secrets. ### 3. OWASP Top 10 Check - **Injection**: SQL injection, command injection, XSS. Search for string concatenation in queries, `eval()`, `innerHTML`. - **Broken Auth**: Weak password policies, missing rate limiting, session fixation. - **Sensitive Data Exposure**: Unencrypted data at rest/transit, verbose error messages, logs containing PII. - **Broken Access Control**: Missing authorization checks, IDOR vulnerabilities, privilege escalation paths. - **Security Misconfiguration**: Default credentials, unnecessary features enabled, CORS wildcards. ### 4. Input Validation - Verify all user inputs are validated before processing. - Check for proper type coercion and boundary checking. - Ensure file uploads have type, size, and name validation. - Verify URL and redirect validation prevents open redirects. ### 5. Authentication and Authorization Review - Check password hashing (bcrypt/argon2, not MD5/SHA1). - Verify JWT token expiration and rotation. - Check for proper CSRF protection. - Verify role-based access control at the API layer, not just the UI. ### 6. Report Produce a findings report organized by severity (Critical, High, Medium, Low, Info) with: - Finding description. - Affected file and line. - Recommended fix. - Reference (CWE number or OWASP category). ## Rules - Prioritize findings by exploitability and impact, not just theoretical risk. - Include proof-of-concept for critical findings when safe to do so. - Do not just list tools to run. Actually analyze the output and provide actionable recommendations. - Check both the application code and infrastructure configuration (Dockerfiles, CI configs, cloud configs).

Our network