Security checklist for web applications. Use when reviewing code security, implementing authentication, handling user input, or working with sensitive data. Covers OWASP Top 10, secrets detection, and security best practices.
Comprehensive security checklist for identifying and preventing vulnerabilities in web applications.
Before committing code, verify:
npm audit)Red Flags:
// ❌ CRITICAL: SQL injection
db.query(`SELECT * FROM users WHERE id = ${userId}`)
db.query("DELETE FROM posts WHERE id = " + postId)
// ❌ CRITICAL: Command injection
exec(`git log --author=${username}`)
Secure Patterns:
// ✅ Parameterized queries
db.query('SELECT * FROM users WHERE id = ?', [userId])
db.query('DELETE FROM posts WHERE id = $1', [postId])
// ✅ Input validation + escaping
const safeUsername = escapeShellArg(username)
exec(`git log --author=${safeUsername}`)
Checklist:
Red Flags:
// ❌ CRITICAL: Weak password hashing
const hash = md5(password)
const hash = sha1(password)
// ❌ CRITICAL: Insecure JWT
jwt.verify(token) // No secret!
jwt.sign(data, 'hardcoded-secret')
// ❌ CRITICAL: Session fixation
session.id = req.query.sessionId
Secure Patterns:
// ✅ Strong password hashing
import bcrypt from 'bcrypt'
const hash = await bcrypt.hash(password, 10)
// ✅ Secure JWT
const secret = process.env.JWT_SECRET
jwt.verify(token, secret, { algorithms: ['HS256'] })
// ✅ Secure session management
session.regenerate() // After login
Checklist:
Red Flags:
// ❌ CRITICAL: Secrets in code
const apiKey = "sk-proj-xxxxx"
const dbPassword = "admin123"
// ❌ CRITICAL: Secrets in logs
console.log('User data:', { password, ssn })
logger.info(`API Key: ${apiKey}`)
// ❌ CRITICAL: PII in URLs
fetch(`/api/user?ssn=${ssn}&creditCard=${cc}`)
Secure Patterns:
// ✅ Environment variables
const apiKey = process.env.OPENAI_API_KEY
if (!apiKey) throw new Error('Missing API key')
// ✅ Sanitized logs
console.log('User data:', { id, email }) // No password
logger.info('API call successful') // No secrets
// ✅ PII in request body
fetch('/api/user', {
method: 'POST',
body: JSON.stringify({ ssn, creditCard })
})
Checklist:
Checklist:
Red Flags:
// ❌ CRITICAL: Missing authorization
app.delete('/api/users/:id', async (req, res) => {
await db.deleteUser(req.params.id) // Anyone can delete!
})
// ❌ CRITICAL: Direct object reference
const file = req.query.file
fs.readFile(`/uploads/${file}`) // Path traversal!
Secure Patterns:
// ✅ Authorization check
app.delete('/api/users/:id', auth, async (req, res) => {
if (req.user.id !== req.params.id && !req.user.isAdmin) {
return res.status(403).json({ error: 'Forbidden' })
}
await db.deleteUser(req.params.id)
})
// ✅ Indirect object reference
const fileId = req.query.fileId
const file = await db.getFile(fileId, req.user.id) // Check ownership
Checklist:
Checklist:
Red Flags:
// ❌ CRITICAL: Unescaped output
element.innerHTML = userInput
dangerouslySetInnerHTML={{ __html: comment }}
eval(userCode)
Secure Patterns:
// ✅ Escaped output
element.textContent = userInput
<div>{comment}</div> // React escapes by default
// ✅ Content Security Policy
res.setHeader('Content-Security-Policy', "default-src 'self'")
Checklist:
Checklist:
Commands:
# Check for vulnerabilities
npm audit
# High severity only
npm audit --audit-level=high
# Fix automatically
npm audit fix
Checklist:
npm audit cleanChecklist:
# Search for potential secrets
grep -r "api[_-]?key\|password\|secret\|token" \
--include="*.js" --include="*.ts" --include="*.json" .
# Check git history
git log -p | grep -i "password\|api_key\|secret"
# Automated scanning
npx trufflehog filesystem . --json
sk-, pk_, api_keyghp_, gho_, tokenpassword=, pwd=-----BEGIN PRIVATE KEY-----postgresql://, mongodb:// with credentialsnpm audit # Check vulnerabilities
npm audit fix # Auto-fix
npm audit --audit-level=high # High severity only
npx eslint . --plugin security
npx semgrep --config auto .
npx trufflehog filesystem . --json
git-secrets --scan
// Express middleware
app.use(helmet()) // Sets multiple security headers
// Manual setup
res.setHeader('X-Frame-Options', 'DENY')
res.setHeader('X-Content-Type-Options', 'nosniff')
res.setHeader('Strict-Transport-Security', 'max-age=31536000')
res.setHeader('Content-Security-Policy', "default-src 'self'")
# ✅ Required in .env (never commit)
OPENAI_API_KEY=sk-...
DATABASE_URL=postgresql://...
JWT_SECRET=random-secret-here
# ✅ Required in .gitignore
.env
.env.local
.env.*.local
import rateLimit from 'express-rate-limit'
const limiter = rateLimit({
windowMs: 15 * 60 * 1000, // 15 minutes
max: 100 // 100 requests per window
})
app.use('/api/', limiter)
Run automated tools
npm auditCheck high-risk areas
Verify OWASP Top 10
Review findings
| Vulnerability | Detection | Fix | |--------------|-----------|-----| | Hardcoded secrets | grep, git log | Move to .env | | SQL injection | Code review | Parameterized queries | | XSS | Code review | Escape output | | Missing auth | Code review | Add auth middleware | | Weak passwords | Code review | Use bcrypt | | Insecure JWT | Code review | Proper validation | | Path traversal | Code review | Validate paths | | CORS misconfigured | Headers check | Configure properly |
npx skills add hellangleZ/security-checklist下载完整 Skill 目录，包含 SKILL.md 及所有相关文件
Search for places (restaurants, cafes, etc.) via Google Places API proxy on localhost.
Interact with GitHub using the `gh` CLI. Use `gh issue`, `gh pr`, `gh run`, and `gh api` for issues, PRs, CI runs, and advanced queries.
Create or update AgentSkills. Use when designing, structuring, or packaging skills with scripts, references, and assets.
Start voice calls via the OpenClaw voice-call plugin.
Notion API for creating and managing pages, databases, and blocks.
Gemini CLI for one-shot Q&A, summaries, and generation.
Category:developer