Skip to content

SPEC_AGE_engineering_securityaudit.md

Latest commit

 

History

History
17 lines (13 loc) · 915 Bytes

SPEC_AGE_engineering_securityaudit.md

File metadata and controls

17 lines (13 loc) · 915 Bytes

SPEC-AGE-009: SecurityAuditEngine

Version: 1.0.0 | Status: verified | TDD: verified | Domain: engineering

Objective

Motor de auditoria estatica de seguranca. Detectar secrets hardcoded, SQL injection, XSS e deficiencias de autenticacao em codigo-fonte. Opera offline com Python 3.12 stdlib.

Acceptance Criteria

  • CT-1: test_ct01_secrets_detection — detect_secrets encontra API_KEY e DB_PASSWORD com severity HIGH
  • CT-2: test_ct02_sql_injection_detection — detect_sql_injection encontra f-strings e concatenacao SQL com count >= 2 sink lines
  • CT-3: test_ct03_xss_detection — detect_xss encontra innerHTML e sinks de XSS com count > 0
  • CT-4: test_ct04_authentication_audit — audit_authentication detecta plaintext password, HttpOnly/Secure ausente, ou MD5 com score < 100

Engine

<scripts/securityaudit_engine.py> -> SecurityAuditEngine

Test Results

All CTs PASSED