Defense in Depth — Security Validation

Multi-layered security audit for web applications. Runs checks across 8 security layers.

Workflow

Run each layer sequentially. Report findings with severity (CRITICAL / HIGH / MEDIUM / LOW) and file:line references.

Layer 1: Secrets Scanning

Search for hardcoded secrets, API keys, tokens, and credentials.

grep -rn "API_KEY\|SECRET_KEY\|DATABASE_URL\|PRIVATE_KEY\|password\s*=\|sk_live\|sk_test" . \
  --include="*.ts" --include="*.tsx" --include="*.js" --include="*.py" --include="*.env" \
  | grep -v node_modules | grep -v ".next" | grep -v ".env.example" | grep -v __pycache__