284 lines
7.5 KiB
Markdown
284 lines
7.5 KiB
Markdown
# COMPREHENSIVE CODEBASE AUDIT PROMPT
|
|
|
|
## INSTRUCTIONS FOR AI AUDITOR
|
|
|
|
You are conducting a **BRUTAL, NO-HOLDS-BARRED, COMPREHENSIVE AUDIT** of the Copper Tone Technologies codebase. Your job is to **find every flaw, vulnerability, inefficiency, anti-pattern, and problem** in this codebase. Do NOT spare feelings. Do NOT sugarcoat findings. Be **ruthlessly critical** and **technically precise**.
|
|
|
|
---
|
|
|
|
## AUDIT SCOPE
|
|
|
|
Audit EVERYTHING:
|
|
- `/home/administrator/projects/coppertone.tech/`
|
|
|
|
### Languages & Technologies to Audit:
|
|
- **Go 1.25+** (backend microservices)
|
|
- **TypeScript/Vue 3** (frontend PWA)
|
|
- **PostgreSQL 16** (database schemas, queries)
|
|
- **SQL Migrations** (schema design)
|
|
- **Docker/Podman** (Containerfiles, compose)
|
|
- **Shell Scripts** (any .sh files)
|
|
- **Configuration** (vite.config, tailwind, tsconfig, etc.)
|
|
|
|
---
|
|
|
|
## AUDIT CATEGORIES
|
|
|
|
### 1. SECURITY AUDIT (CRITICAL)
|
|
|
|
**Authentication & Authorization:**
|
|
- JWT implementation flaws (algorithm confusion, weak secrets, missing expiration)
|
|
- Session management vulnerabilities
|
|
- Role-based access control (RBAC) bypasses
|
|
- Privilege escalation vectors
|
|
- Missing authentication on endpoints
|
|
- Broken access control (IDOR, horizontal/vertical escalation)
|
|
|
|
**Input Validation & Injection:**
|
|
- SQL injection (even with parameterized queries, check for string concatenation)
|
|
- Command injection in any shell calls
|
|
- XSS (stored, reflected, DOM-based) in Vue components
|
|
- CSRF vulnerabilities
|
|
- Path traversal
|
|
- LDAP/XML injection if applicable
|
|
- Template injection
|
|
|
|
**Cryptography:**
|
|
- Weak hashing algorithms (MD5, SHA1 for passwords)
|
|
- Hardcoded secrets, API keys, passwords
|
|
- Insecure random number generation
|
|
- Missing encryption for sensitive data at rest/transit
|
|
- Certificate validation issues
|
|
|
|
**API Security:**
|
|
- Missing rate limiting
|
|
- Verbose error messages leaking info
|
|
- CORS misconfiguration
|
|
- Missing security headers
|
|
- Insecure direct object references
|
|
- Mass assignment vulnerabilities
|
|
- GraphQL-specific issues if applicable
|
|
|
|
**Infrastructure Security:**
|
|
- Container security (running as root, privileged mode)
|
|
- Exposed ports unnecessarily
|
|
- Secrets in environment variables vs secret management
|
|
- Database credentials handling
|
|
- SSL/TLS configuration
|
|
|
|
### 2. CODE QUALITY AUDIT
|
|
|
|
**Go Backend:**
|
|
- Error handling (swallowed errors, panic vs error return)
|
|
- Resource leaks (unclosed DB connections, file handles, HTTP bodies)
|
|
- Race conditions (missing mutex, improper channel usage)
|
|
- Memory leaks
|
|
- Goroutine leaks
|
|
- Context propagation issues
|
|
- Improper use of defer
|
|
- Magic numbers and strings
|
|
- God functions (>50 lines)
|
|
- Cyclomatic complexity
|
|
- Dead code
|
|
- Unused imports/variables
|
|
- Inconsistent naming conventions
|
|
- Missing godoc comments
|
|
- Test coverage gaps
|
|
|
|
**TypeScript/Vue Frontend:**
|
|
- Type safety violations (any abuse, type assertions)
|
|
- Reactive state management issues
|
|
- Memory leaks (event listeners, subscriptions)
|
|
- Component coupling
|
|
- Props drilling
|
|
- Missing error boundaries
|
|
- Accessibility (a11y) violations
|
|
- Performance anti-patterns (unnecessary re-renders)
|
|
- Bundle size concerns
|
|
- Dead code and unused exports
|
|
- Inconsistent code style
|
|
- Missing TypeScript strict mode violations
|
|
|
|
**SQL/Database:**
|
|
- N+1 query problems
|
|
- Missing indexes
|
|
- Inefficient queries (SELECT *, unnecessary JOINs)
|
|
- Schema normalization issues
|
|
- Missing foreign key constraints
|
|
- Data integrity gaps
|
|
- Migration safety (irreversible migrations)
|
|
- Connection pool mismanagement
|
|
|
|
### 3. ARCHITECTURE AUDIT
|
|
|
|
**Backend Architecture:**
|
|
- Microservice boundaries (too fine/coarse grained)
|
|
- Service coupling issues
|
|
- Missing circuit breakers
|
|
- No retry logic with backoff
|
|
- Synchronous calls that should be async
|
|
- Missing event sourcing where beneficial
|
|
- API versioning strategy
|
|
- Inconsistent API design across services
|
|
|
|
**Frontend Architecture:**
|
|
- State management complexity
|
|
- Component hierarchy issues
|
|
- Route organization
|
|
- Code splitting effectiveness
|
|
- Lazy loading implementation
|
|
- Service layer abstraction
|
|
- API client design
|
|
|
|
**Data Architecture:**
|
|
- Schema design flaws
|
|
- Missing audit trails
|
|
- No soft deletes where needed
|
|
- Timestamp handling (timezone issues)
|
|
- Data retention policies
|
|
|
|
### 4. PERFORMANCE AUDIT
|
|
|
|
**Backend Performance:**
|
|
- Database query optimization
|
|
- Caching strategy (or lack thereof)
|
|
- Connection pooling configuration
|
|
- Payload sizes
|
|
- Compression usage
|
|
- Async processing opportunities
|
|
|
|
**Frontend Performance:**
|
|
- Lighthouse scores analysis
|
|
- Core Web Vitals
|
|
- Image optimization
|
|
- Asset caching
|
|
- Tree shaking effectiveness
|
|
- Code splitting
|
|
- Lazy loading
|
|
- Memory profiling
|
|
|
|
### 5. RELIABILITY AUDIT
|
|
|
|
- Error handling completeness
|
|
- Graceful degradation
|
|
- Health check implementation
|
|
- Logging strategy (structured logging, log levels)
|
|
- Monitoring hooks
|
|
- Alerting capabilities
|
|
- Backup and recovery
|
|
- Data consistency guarantees
|
|
|
|
### 6. MAINTAINABILITY AUDIT
|
|
|
|
- Documentation completeness
|
|
- README accuracy
|
|
- API documentation
|
|
- Inline code comments (too few/too many)
|
|
- Consistent project structure
|
|
- Dependency management
|
|
- Version pinning
|
|
- Technical debt identification
|
|
- TODO/FIXME/HACK comments
|
|
|
|
### 7. TESTING AUDIT
|
|
|
|
- Unit test coverage percentage
|
|
- Integration test coverage
|
|
- E2E test coverage
|
|
- Test quality (not just quantity)
|
|
- Mocking strategy
|
|
- Test data management
|
|
- CI/CD test integration
|
|
- Missing edge case tests
|
|
- Flaky tests
|
|
|
|
### 8. COMPLIANCE AUDIT
|
|
|
|
- OWASP Top 10 compliance
|
|
- GDPR considerations (if handling EU data)
|
|
- PCI-DSS considerations (payment handling)
|
|
- Accessibility (WCAG 2.1)
|
|
- License compliance for dependencies
|
|
|
|
---
|
|
|
|
## OUTPUT FORMAT
|
|
|
|
For each finding, provide:
|
|
|
|
```
|
|
### [SEVERITY: CRITICAL/HIGH/MEDIUM/LOW/INFO] - [Category] - [Short Title]
|
|
|
|
**File(s):** `path/to/file.go:line_number`
|
|
|
|
**Description:**
|
|
Detailed explanation of the issue.
|
|
|
|
**Evidence:**
|
|
```code
|
|
// The problematic code
|
|
```
|
|
|
|
**Impact:**
|
|
What could go wrong? Attack scenarios, data loss, etc.
|
|
|
|
**Remediation:**
|
|
Specific fix with code example if applicable.
|
|
|
|
**References:**
|
|
- CWE/CVE numbers if applicable
|
|
- OWASP references
|
|
- Best practice documentation
|
|
```
|
|
|
|
---
|
|
|
|
## SEVERITY DEFINITIONS
|
|
|
|
- **CRITICAL**: Immediate exploitation possible, data breach, system compromise
|
|
- **HIGH**: Significant security/reliability risk, exploitable with some effort
|
|
- **MEDIUM**: Should be fixed, moderate risk or significant code quality issue
|
|
- **LOW**: Minor issues, best practice violations
|
|
- **INFO**: Observations, suggestions, nice-to-haves
|
|
|
|
---
|
|
|
|
## DELIVERABLES REQUIRED
|
|
|
|
1. **Executive Summary**: 1-page overview for stakeholders
|
|
2. **Detailed Findings Report**: All issues with full details
|
|
3. **Prioritized Remediation Plan**: What to fix first
|
|
4. **Statistics Dashboard**:
|
|
- Total issues by severity
|
|
- Issues by category
|
|
- Files with most issues
|
|
- Estimated remediation effort
|
|
|
|
---
|
|
|
|
## SPECIFIC AREAS OF CONCERN
|
|
|
|
Based on this codebase, pay EXTRA attention to:
|
|
|
|
1. **Multi-factor authentication implementation** - blockchain signature verification
|
|
2. **Project approval workflow** - new feature, likely has gaps
|
|
3. **Payment processing** - Stripe integration, financial data handling
|
|
4. **IPFS integration** - P2P storage security implications
|
|
5. **Role-based access control** - CLIENT/STAFF/ADMIN boundaries
|
|
6. **JWT implementation** - token handling, refresh logic
|
|
7. **Database schema separation** - dev/test/prod isolation
|
|
8. **Container security** - Podman configuration
|
|
|
|
---
|
|
|
|
## BEGIN AUDIT
|
|
|
|
Start by:
|
|
1. Running all automated audit scripts in `scripts/audit/`
|
|
2. Analyzing output files generated
|
|
3. Conducting manual code review
|
|
4. Cross-referencing findings
|
|
5. Generating comprehensive report
|
|
|
|
**DO NOT STOP until every file has been examined. Leave no stone unturned.**
|