Back to Details

security-check

Compare original and translation side by side

🇺🇸

Original

English
🇨🇳

Translation

Chinese

Security Check

安全检查

Red-team style security review for code changes. Think like an attacker.
针对代码变更的红队式安全审查，以攻击者的视角思考。

Modes

模式

1. Pending Changes (default)

1. 待提交变更（默认）

Review uncommitted changes in the current working directory:
bash
git diff HEAD
git diff --cached  # staged changes
审查当前工作目录中未提交的变更：
bash
git diff HEAD
git diff --cached  # 暂存的变更

2. Branch vs Main

2. 分支与主分支对比

Review all commits on a branch against main:
bash
git log main..<branch> --oneline  # list commits
git diff main...<branch>          # three dots = merge-base diff
审查某分支相对于主分支的所有提交：
bash
git log main..<branch> --oneline  # 列出提交记录
git diff main...<branch>          # 三个点表示基于合并基准的差异

3. Specific Commit Range

3. 指定提交范围

bash
git diff <commit1>..<commit2>
bash
git diff <commit1>..<commit2>

Review Checklist

审查检查清单

Input Validation

输入验证

  • User input sanitized before use?
  • SQL injection vectors?
  • Command injection (shell escapes)?
  • Path traversal (
    ../
    in file paths)?
  • XSS in HTML/JS output?
  • Prototype pollution (JS objects)?
  • 用户输入是否在使用前经过清理？
  • 是否存在SQL注入风险？
  • 是否存在命令注入（Shell转义问题）？
  • 是否存在路径遍历（文件路径中的
    ../
    ）？
  • HTML/JS输出中是否存在XSS？
  • JS对象是否存在原型污染？

Authentication & Authorization

身份认证与授权

  • Auth checks on all sensitive endpoints?
  • Permission escalation paths?
  • Session handling flaws?
  • Token exposure in logs/URLs?
  • Missing rate limiting?
  • 所有敏感端点是否都有认证检查？
  • 是否存在权限提升路径？
  • 会话处理是否存在缺陷？
  • 令牌是否在日志/URL中暴露？
  • 是否缺少速率限制？

Secrets & Configuration

密钥与配置

  • Hardcoded credentials/API keys?
  • Secrets in logs or error messages?
  • Insecure defaults?
  • Debug mode left enabled?
  • .env
    files committed?
  • 是否存在硬编码的凭证/API密钥？
  • 密钥是否出现在日志或错误信息中？
  • 是否存在不安全的默认配置？
  • 调试模式是否未关闭？
  • .env
    文件是否被提交？

Data Exposure

数据暴露

  • Sensitive data in responses?
  • PII leaked in logs?
  • Stack traces exposed to users?
  • Internal paths/IPs revealed?
  • 响应中是否包含敏感数据？
  • 日志中是否泄露个人可识别信息（PII）？
  • 是否向用户暴露堆栈跟踪？
  • 是否泄露内部路径/IP？

Cryptography

加密

  • Weak algorithms (MD5, SHA1 for security)?
  • Hardcoded IVs/salts?
  • Predictable random values?
  • Missing HTTPS enforcement?
  • 是否使用弱算法（如用于安全场景的MD5、SHA1）？
  • 是否存在硬编码的IV/盐值？
  • 随机值是否可预测？
  • 是否未强制使用HTTPS？

Dependencies

依赖项

  • Known vulnerable packages?
  • Unpinned versions?
  • Typosquatting risk?
  • 是否存在已知漏洞的包？
  • 版本是否未固定？
  • 是否存在打字劫持风险？

File Operations

文件操作

  • Arbitrary file read/write?
  • Unsafe deserialization?
  • Temp file races?
  • Symlink attacks?
  • 是否存在任意文件读写？
  • 是否存在不安全的反序列化？
  • 是否存在临时文件竞争？
  • 是否存在符号链接攻击？

Process & Network

进程与网络

  • SSRF vectors?
  • Open redirects?
  • Unsafe subprocess calls?
  • Missing timeouts?
  • 是否存在SSRF风险？
  • 是否存在开放重定向？
  • 是否存在不安全的子进程调用？
  • 是否缺少超时设置？

Output Format

输出格式

For each finding:
🔴 [CRITICAL|HIGH|MEDIUM|LOW] <Title>

📍 Location: <file:line>

💀 Attack Vector:
<How an attacker would exploit this>

📝 Code:
<relevant snippet>

✅ Fix:
<suggested remediation>
每个问题的输出格式：
🔴 [CRITICAL|HIGH|MEDIUM|LOW] <标题>

📍 位置: <文件:行号>

💀 攻击向量:
<攻击者如何利用该漏洞>

📝 代码:
<相关代码片段>

✅ 修复方案:
<建议的修复措施>

Workflow

工作流程

  1. Identify scope — Ask which mode (pending/branch/commit range)
  2. Get the diff — Run appropriate git commands
  3. Analyze systematically — Go through checklist
  4. Prioritize findings — CRITICAL > HIGH > MEDIUM > LOW
  5. Suggest fixes — Concrete code changes, not vague advice
  6. Summary — Executive summary with risk assessment
  1. 确定范围 — 询问使用哪种模式（待提交/分支/提交范围）
  2. 获取差异 — 运行对应的Git命令
  3. 系统分析 — 逐一检查清单内容
  4. 优先级排序 — CRITICAL > HIGH > MEDIUM > LOW
  5. 建议修复 — 给出具体的代码变更建议，而非模糊的指导
  6. 总结 — 包含风险评估的执行摘要

Quick Commands

快速命令

bash
undefined
bash
undefined

Pending changes

待提交变更

git diff HEAD
git diff HEAD

Branch review

分支审查

git diff main...feature-branch
git diff main...feature-branch

Check for secrets (basic)

检查密钥（基础版）

git diff HEAD | grep -iE "(password|secret|api.?key|token|credential)"
git diff HEAD | grep -iE "(password|secret|api.?key|token|credential)"

Check for dangerous functions

检查危险函数

git diff HEAD | grep -iE "(eval|exec|system|shell_exec|passthru|popen)"
undefined
git diff HEAD | grep -iE "(eval|exec|system|shell_exec|passthru|popen)"
undefined

Risk Levels

风险等级

  • CRITICAL: Exploitable now, high impact (RCE, auth bypass, data breach)
  • HIGH: Likely exploitable, significant impact
  • MEDIUM: Exploitable under specific conditions
  • LOW: Defense-in-depth issues, minor exposure
  • CRITICAL（严重）: 当前可被利用，影响重大（远程代码执行、认证绕过、数据泄露）
  • HIGH（高）: 很可能被利用，影响显著
  • MEDIUM（中）: 在特定条件下可被利用
  • LOW（低）: 纵深防御问题，暴露程度轻微