security-scan

# Security Scan Scan code for security vulnerabilities and report findings with remediation guidance. ## Instructions 1. Identify the project's language, framework, and dependency manager. 2. Scan for OWASP Top 10 vulnerabilities: - **Injection**: SQL injection, command injection, XSS, template injection. Search for string concatenation in queries, unsanitized user input in shell commands or HTML output. - **Broken Authentication**: Weak password handling, missing rate limiting, session fixation. - **Sensitive Data Exposure**: Hardcoded secrets, API keys, passwords, tokens in source files or config. Grep for patterns like `password=`, `secret`, `api_key`, `token`, base64-encoded credentials. - **Insecure Deserialization**: Use of pickle, eval, unserialize, or YAML.load with untrusted data. - **Missing Input Validation**: Endpoints or functions accepting user input without type checks, length limits, or sanitization. - **Security Misconfiguration**: Debug mode enabled, CORS wildcard, permissive file permissions, missing security headers. - **Vulnerable Dependencies**: Run `npm audit`, `pip audit`, or equivalent to check for known CVEs. 3. For each finding, report: - **Severity**: Critical, High, Medium, or Low - **Location**: File path and line number - **Description**: What the vulnerability is and how it could be exploited - **Remediation**: Specific steps or code changes to fix it 4. Sort findings by severity (critical first). 5. If no vu...