add-security-auditlisted

# Security Audit **Use for:** Validate security, audit codebase, identify vulnerabilities **Do not use for:** Writing security fixes, dependency upgrades, incident response, general code review **Reference:** Always consult `CLAUDE.md` for general project standards. --- ## OWASP Checklist ### A01 — Broken Access Control (CRITICAL) Multi-tenant rules: - [ ] ALL queries filter by `account_id` - [ ] `account_id` from JWT (NEVER body) - [ ] Ownership validated before UPDATE/DELETE - [ ] Guards on protected endpoints Searches to run: - `grep 'findAll|selectFrom'` → check `account_id` filter - `grep '@Body()'` → check no `accountId` from body --- ### A02 — Cryptographic Failures - [ ] Credentials encrypted - [ ] Passwords NEVER in logs - [ ] Tokens not in responses - [ ] API keys via env vars - [ ] Secrets not committed Searches: - `grep 'sk_live|api_key|secret'` → no hardcoded - `grep 'logger|console'` → no sensitive data --- ### A03 — Injection (CRITICAL) SQL/NoSQL: - [ ] Parametrized queries - [ ] Validated inputs - [ ] No `.raw()` with user input Command injection: - [ ] No `exec`/`spawn` with user input Searches: - `grep 'raw('` → check user input - `grep '${'` in queries → SQL injection --- ### A04 — Insecure Design - [ ] Guards on ALL protected routes - [ ] JWT expiration - [ ] Refresh token handling - [ ] Logout invalidates session Search: `grep '@Get|@Post'` → check `@UseGuards`. --- ### A05 — Misconfiguration - [ ] CORS not `origin:'*'` in pro