security-scan

To scan a codebase for hardcoded secrets, this skill audits frontend, backend, and API services to identify exposed API keys and credentials, then reports them as high-risk findings. It detects hardcoded secrets to prevent unauthorized access.

Detecting XSS risks involves scanning for unsanitized user input rendering across the application. This skill identifies XSS vulnerabilities by checking how user inputs are handled and rendered, providing recommended fixes for any detected security gaps.

Auditing API endpoints for authentication bypass patterns requires verifying that all services enforce proper authentication. This skill performs an auth pattern audit across backend and API services to locate endpoints missing valid authentication checks.

Yes, you can check for proper AI credit refund logic. This skill audits AI endpoints to ensure they correctly implement credit deduction and refund handling, verifying that the specific business logic requirements are met.

Yes, the security scan checks .gitignore coverage. It verifies that sensitive files are properly ignored in version control, preventing accidental exposure of credentials and configuration files within the repository.

You need to run a codebase security audit before release when you want to proactively identify exposed secrets, authentication gaps, and risky logic. It surfaces high-risk findings early, ensuring your codebase is secure for production deployment.