Secure Code Guardian

Secure Code Guardian is a community skill for automated security analysis of source code, covering vulnerability detection, dependency auditing, secret scanning, secure coding patterns, and compliance checks across application codebases.

What Is This?

Overview

Secure Code Guardian provides tools for identifying and remediating security vulnerabilities in application source code. It covers vulnerability detection that scans code for common security flaws including injection attacks, authentication bypasses, and insecure data handling, dependency auditing that checks third-party packages for known vulnerabilities using CVE databases, secret scanning that identifies hardcoded credentials, API keys, and tokens in source files, secure pattern enforcement that validates code follows established security best practices, and compliance checking that verifies code meets security standards such as OWASP guidelines. The skill helps development teams maintain secure codebases.

Who Should Use This

This skill serves security engineers reviewing application code, developers building security-sensitive features, and DevSecOps teams integrating automated security checks into CI pipelines.

Why Use It?

Problems It Solves

Manual security reviews are time-intensive and may miss subtle vulnerabilities in large codebases. Hardcoded secrets in source code can lead to credential exposure when repositories are shared or published. Third-party dependencies introduce transitive vulnerabilities that are difficult to track manually. Inconsistent application of security patterns across a team leads to uneven protection levels.

Core Highlights

Vulnerability scanner detects injection, authentication, and data handling flaws. Dependency auditor checks packages against CVE databases. Secret detector finds hardcoded credentials and API keys in source files. Compliance checker validates code against OWASP security guidelines.

How to Use It?

Basic Usage

import re
import ast
from pathlib import Path

class SecurityScanner:
  SECRET_PATTERNS = [
    (r'(?i)api[_-]?key'
     r'\s*=\s*[\'"]'
     r'[A-Za-z0-9]{16,}',
     'API key'),
    (r'(?i)password'
     r'\s*=\s*[\'"]'
     r'[^\'"]+',
     'Password'),
    (r'(?i)secret'
     r'\s*=\s*[\'"]'
     r'[^\'"]+',
     'Secret')]

  def scan_secrets(
    self, filepath: str
  ) -> list:
    text = Path(
      filepath
    ).read_text()
    findings = []
    for pattern, label in (
      self.SECRET_PATTERNS
    ):
      for m in re.finditer(
        pattern, text
      ):
        line = (
          text[
            :m.start()
          ].count('\n')
          + 1)
        findings.append({
          'type': label,
          'line': line,
          'file': filepath})
    return findings

  def scan_sql_injection(
    self, filepath: str
  ) -> list:
    text = Path(
      filepath
    ).read_text()
    findings = []
    pattern = (
      r'execute\s*\(\s*'
      r'f[\'"]')
    for m in re.finditer(
      pattern, text
    ):
      line = (
        text[
          :m.start()
        ].count('\n')
        + 1)
      findings.append({
        'type': 'SQL '
          'injection',
        'line': line})
    return findings

scanner = SecurityScanner()
secrets = scanner\
  .scan_secrets('app.py')
for s in secrets:
  print(
    f'Line {s["line"]}: '
    f'{s["type"]}')

Real-World Examples

import subprocess
import json

class DependencyAuditor:
  def audit_python(
    self,
    requirements: str
  ) -> dict:
    result = subprocess.run(
      ['pip', 'audit',
       '-r', requirements,
       '--format', 'json'],
      capture_output=True,
      text=True)
    if result.returncode:
      data = json.loads(
        result.stdout)
      vulns = data.get(
        'vulnerabilities',
        [])
      return {
        'total':
          len(vulns),
        'critical': sum(
          1 for v in vulns
          if v.get(
            'severity'
          ) == 'critical'),
        'details': vulns}
    return {
      'total': 0,
      'critical': 0,
      'details': []}

  def audit_npm(
    self, path: str
  ) -> dict:
    result = subprocess.run(
      ['npm', 'audit',
       '--json'],
      capture_output=True,
      text=True,
      cwd=path)
    data = json.loads(
      result.stdout)
    return {
      'total': data.get(
        'metadata', {})
        .get(
          'vulnerabilities',
          {}),
      'advisories':
        list(
          data.get(
            'advisories',
            {}).keys())}

auditor = DependencyAuditor()
py_results = (
  auditor.audit_python(
    'requirements.txt'))
print(
  f'Found '
  f'{py_results["total"]} '
  f'vulnerabilities')

Advanced Tips

Integrate security scanning into pre-commit hooks to catch vulnerabilities before code reaches the repository. Maintain an allowlist for known false positives to reduce alert fatigue. Combine static analysis with dynamic testing for comprehensive security coverage across the application.

When to Use It?

Use Cases

Scan a pull request for hardcoded secrets before merging to the main branch. Audit project dependencies for known CVE vulnerabilities during a security review cycle. Validate that input handling follows parameterized query patterns across all database access code.

Related Topics

Application security, SAST, dependency scanning, secret detection, OWASP, DevSecOps, and vulnerability management.

Important Notes

Requirements

Access to source code files and dependency manifests for scanning. Security tools such as pip-audit or npm audit installed for dependency checking. Familiarity with common vulnerability patterns and secure coding practices for interpreting results.

Usage Recommendations

Do: run security scans regularly as part of the development workflow, not just before releases. Prioritize findings by severity and fix critical vulnerabilities immediately. Keep dependency versions updated to receive security patches promptly.

Don't: rely solely on automated scanning since tools cannot detect all vulnerability classes such as business logic flaws. Suppress security warnings without documenting the justification and risk acceptance. Store secrets in source code even temporarily during development.

Limitations

Static analysis produces false positives that require manual triage to confirm actual vulnerabilities. Pattern-based secret detection may miss obfuscated or indirectly referenced credentials. Automated scanners cannot assess business logic vulnerabilities or complex authorization flaws that depend on application context.