Security

---
name: security-gate
description: Verifies security before merge/deploy including OWASP Top 10, input validation, and auth checks. WARNING gate triggered during /own:done flow.
---

# Gate 2: Security Review

> "Security isn't a feature you add later. It's a foundation you build on."

## Purpose

This gate catches common security vulnerabilities before they reach production. Issues don't BLOCK, but generate strong WARNINGS.

## Gate Status

- **PASS** — No security issues found
- **WARNING** — Issues found that should be fixed before production
- **CRITICAL WARNING** — Severe issues that really should block

---

## Gate Questions

### Question 1: Input Entry Points
> "Where does user input enter this feature?"

**Looking for:**
- Awareness of all input sources (forms, URLs, headers, etc.)
- Understanding that ALL input is untrusted
- Identification of data flow

**Follow-up if input exists:**
> "How is that input validated before it's used?"

### Question 2: Data Access
> "What data does this feature access? Who should be able to access it?"

**Looking for:**
- Understanding of data sensitivity
- Awareness of authorization requirements
- Knowledge of who can see what

**Follow-up:**
> "How do you verify the requesting user is allowed to access this data?"

### Question 3: Secrets and Exposure
> "Are there any secrets, tokens, or sensitive data involved? Where are they stored?"

**Looking for:**
- Secrets in environment variables, not code
- No sensitive data in logs
- No tokens in URLs or client-side storage (unless necessary)

---

## Security Checklist

Review the code for these common issues:

### Input Handling
- [ ] All user input validated server-side
- [ ] Input length limits enforced
- [ ] Special characters handled (SQL, HTML, shell)
- [ ] File uploads validated (type, size, content)

### Authentication & Authorization
- [ ] Protected routes require authentication
- [ ] Users can only access their own data
- [ ] Admin routes check admin role
- [ ] Tokens have reasonable expiration

### Data Exposure
- [ ] API responses don't include unnecessary fields
- [ ] Errors don't expose internal details
- [ ] Logs don't contain passwords/tokens
- [ ] No sensitive data in URLs

### Common Vulnerabilities
- [ ] No SQL string concatenation
- [ ] No `eval()` or `new Function()` with user input
- [ ] No `innerHTML` with unsanitized user input
- [ ] No hardcoded secrets in code

---

## Response Templates

### If PASS

```
✅ SECURITY GATE: PASSED

Security considerations addressed:
- Input validation: ✓
- Authorization checks: ✓
- No exposed secrets: ✓

Moving to the next gate...
```

### If WARNING

```
⚠️ SECURITY GATE: WARNING

I found [X] security considerations to address:

**Issue 1: [Title]**
Location: `file.ts:42`
Risk: [What could go wrong]
Question: "What stops a malicious user from [attack scenario]?"

**Issue 2: [Title]**
Location: `file.ts:88`
Risk: [What could go wrong]
Suggestion: [Direction to fix, not the answer]

These should be fixed before this goes to production.
Would you like to address them now?
```

### If CRITICAL WARNING

```
🚨 SECURITY GATE: CRITICAL WARNING

This needs attention before proceeding:

**CRITICAL: [Issue]**
Location: `file.ts:42`
Risk: [Severity explanation - data breach, account takeover, etc.]

This is the kind of vulnerability that makes news headlines.
Let's fix this before anything else.
```

---

## Common Vulnerabilities to Check

### SQL Injection
```
❌ db.query(`SELECT * FROM users WHERE id = ${userId}`);
✅ db.query('SELECT * FROM users WHERE id = ?', [userId]);
```

### Cross-Site Scripting (XSS)
```
❌ element.innerHTML = userInput;
✅ element.textContent = userInput;
```

### Insecure Direct Object Reference (IDOR)
```
❌ // Anyone can access any user's data
   app.get('/users/:id', (req, res) => {
     const user = await User.findById(req.params.id);
     res.json(user);
   });

✅ // Check ownership
   app.get('/users/:id', (req, res) => {
     const user = await User.findById(req.params.id);
     if (user.id !== req.user.id) throw new ForbiddenError();
     res.json(user);
   });
```

### Hardcoded Secrets
```
❌ const apiKey = 'sk-live-abc123';
✅ const apiKey = process.env.API_KEY;
```

---

## Socratic Security Questions

Instead of pointing out the fix, ask:

1. "What stops user A from accessing user B's data by changing the ID?"
2. "If I send `<script>alert('XSS')</script>` as my name, what happens?"
3. "What if someone sends 10MB of data to this endpoint?"
4. "If I cloned this repo, what secrets would I see?"
5. "What happens if someone guesses another user's token?"

---

## Risk Level Guide

| Issue | Risk Level | Action |
|-------|------------|--------|
| SQL injection possible | CRITICAL | Must fix |
| No rate limiting on auth | HIGH | Should fix |
| Missing authorization check | HIGH | Should fix |
| XSS possible | HIGH | Should fix |
| Verbose error messages | MEDIUM | Recommend fix |
| Missing input validation | MEDIUM | Recommend fix |
| No CSRF protection | MEDIUM | Recommend fix |
| CORS too permissive | LOW | Note for review |