Security Scan Quick

Run a fast automated security scan of your codebase to identify common vulnerabilities, dependency issues, and security misconfigurations.

What This Command Does

Quick Security Analysis in under 5 minutes:

• Scans for hardcoded secrets and credentials
• Checks dependencies for known CVEs
• Identifies insecure configurations
• Detects common vulnerability patterns
• Provides severity-rated findings with fixes

Output: Security scan report with actionable remediation steps

Time: 2-5 minutes (depending on project size)

When to Use This Command

Perfect For:

• Quick security check before committing code
• Pre-deployment security verification
• Regular security hygiene (weekly scans)
• Onboarding new team members to security practices
• Compliance requirement (quick audit trail)

Use This When:

• You want fast security feedback
• Before deploying to production
• After adding new dependencies
• Joining a new project (assess security posture)
• Regular security maintenance

Usage

# Scan current directory
/security-scan-quick

# Scan specific directory
/security-scan-quick /path/to/project

# Scan with detailed output
/security-scan-quick --verbose

# Scan and save report
/security-scan-quick --output report.md

Shortcut:

/ss  # Quick scan current directory

What Gets Scanned

1. Secret Detection (Critical Priority)

Scans For:

• API keys and tokens
• Database credentials
• Private keys (RSA, SSH)
• OAuth secrets
• Cloud provider credentials (AWS, GCP, Azure)
• JWT secrets
• Encryption keys

Example Findings:

//  CRITICAL: Hardcoded AWS credentials
const AWS_ACCESS_KEY = "AKIAIOSFODNN7EXAMPLE"
const AWS_SECRET_KEY = "wJalrXUtnFEMI/K7MDENG/bPxRfiCYEXAMPLEKEY"

// File: config/aws.js:12-13
// Severity: Critical
// Fix: Move to environment variables or AWS IAM roles

2. Dependency Vulnerabilities (High Priority)

Checks:

• npm packages (Node.js)
• pip packages (Python)
• gem packages (Ruby)
• Maven dependencies (Java)
• NuGet packages (.NET)

Example Findings:

 Critical Vulnerability in [email protected]

CVE: CVE-2020-8203
Severity: High (CVSS 7.4)
Vulnerable: lodash < 4.17.19
Fixed in: lodash >= 4.17.19

Vulnerability: Prototype Pollution
Impact: Remote code execution possible via crafted input

Fix: npm install lodash@^4.17.19

3. Security Misconfigurations (Medium Priority)

Scans For:

• Debug mode enabled in production
• Insecure CORS configurations
• Missing security headers
• Weak SSL/TLS settings
• Verbose error messages
• Default credentials
• Exposed admin panels

Example Findings:

// ️  HIGH: Debug mode enabled
app.set('debug', true)  // Should be false in production

// ️  HIGH: Permissive CORS
app.use(cors({ origin: '*' }))  // Allows all origins

//  MEDIUM: Missing security headers
// Recommendation: Add helmet.js middleware

4. Common Vulnerability Patterns (Medium Priority)

Code Pattern Detection:

• SQL injection vulnerabilities
• XSS (Cross-Site Scripting) risks
• Path traversal possibilities
• Command injection risks
• Insecure deserialization
• Weak cryptography usage

Example Findings:

# ️  HIGH: SQL Injection risk
query = f"SELECT * FROM users WHERE id = {user_id}"  # String interpolation
cursor.execute(query)

# File: api/users.py:45
# Severity: High
# Fix: Use parameterized queries
# cursor.execute("SELECT * FROM users WHERE id = ?", (user_id,))

Example: Full Scan Output

$ /security-scan-quick

 Running Quick Security Scan...

 Project: my-express-api
 Files scanned: 247
⏱️  Scan duration: 3.2 seconds

━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
 CRITICAL ISSUES (Fix Immediately)
━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━

1. Hardcoded Database Password
    File: config/database.js:8
    Severity: Critical

   const DB_PASSWORD = "MySecretPassword123!"
…

Interpreting Results

Severity Levels

Critical (Fix Immediately - Within 24 Hours)

• Hardcoded secrets/credentials
• Known critical CVEs (CVSS 9.0+)
• Authentication bypasses
• SQL injection vulnerabilities

Risk: Active exploitation possible, immediate data breach

High (Fix Before Production - Within 1 Week)

• High-severity CVEs (CVSS 7.0-8.9)
• Authorization flaws
• Missing security controls
• Weak cryptography

Risk: Significant security impact, exploitation likely

Medium (Improve Security Posture - Within 1 Month)