security-audit

Security Audit

Instructions

1. Command Execution Review (backend/main.py):
2. Check run_terminal_command() for shell injection vulnerabilities
3. Verify timeout is enforced (should be 15 seconds)
4. Look for dangerous command patterns

1. Tool Permission Review:
2. Verify Chat mode only allows: read_file, web_search
3. Check Agent mode tool restrictions
4. Look for permission bypass vulnerabilities

1. Secrets Management:
2. Ensure .env is in .gitignore
3. Check no API keys are hardcoded
4. Verify python-dotenv usage for environment variables

1. WebSocket Security:
2. Check for authentication on /ws endpoint
3. Review message validation
4. Look for injection points in user input

1. Frontend Security:
2. Check for XSS in markdown rendering
3. Review image upload handling (base64 encoding)
4. Verify no sensitive data in client-side code

1. Generate report with:
2. Critical issues (immediate action required)
3. Warnings (should fix before production)
4. Recommendations (best practices)

Examples

• "Run a security audit"
• "Check for vulnerabilities"
• "Review security before deploy"

Guardrails

• This is a READ-ONLY audit; do not modify files
• Report findings without exploiting vulnerabilities
• Recommend fixes but get user approval before implementing
• Never log or expose discovered secrets