API Security & SOC 2 Audit

Overview

Four-phase security audit covering OWASP Top 10 vulnerabilities and SOC 2 CC6/CC7/CC8 controls — from feature design through PR merge. Works with any stack or architecture.

Core principle: Every input is hostile until validated. Every endpoint is public until proven gated.

When to Use / Not Use

Use when:

• Designing a feature touching auth, file uploads, user data, or outbound HTTP calls
• Writing or reviewing any backend endpoint, service, or data-access layer
• Before merging any PR that adds or modifies an endpoint
• Investigating a security incident — find the missed control

Skip for:

• Pure styling or copy changes with no data flow
• Infrastructure-only changes (DNS, CDN) with no application code

Phase Selector

digraph phases {
    rankdir=LR;
    T [label="Task?", shape=diamond];
    P1 [label="Phase 1\nArchitecture\nchecklist.md"];
    P2 [label="Phase 2\nCode Audit\nchecklist.md"];
    P3 [label="Phase 3\nAPI Tests\ntesting.md"];
    P4 [label="Phase 4\nSOC 2\ntesting.md"];
    STOP [label="STOP\nFix CRITICAL first", style=filled];
    MERGE [label="Pre-merge:\nRun P2+P3+P4", shape=box];

    T -> P1 [label="new feature"];
    T -> P2 [label="reviewing code"];
    T -> P3 [label="new endpoint"];
    T -> MERGE [label="before PR merge"];
    T -> STOP [label="CRITICAL found"];
    MERGE -> P2;
    MERGE -> P3;
    MERGE -> P4;
}

Enforcement Rules (non-negotiable)

Condition	Result
CRITICAL vulnerability found	BLOCK — fix before anything else
Input validation missing on any endpoint	FAIL
Auth missing on any route	FAIL
Secret hardcoded in source	FAIL
Mutation not audit-logged	WARNING (SOC 2 gap)
"Looks fine" without running checks	INVALID — proof required

Red Flags — Stop Rationalizing

Thought	Reality
"It's internal — no auth needed"	Insiders are threat actors. Auth is required everywhere.
"The ORM prevents injection"	Raw query helpers and operator injection bypass the ORM
"Middleware handles auth"	Middleware can be missing or misconfigured on new routes
"Frontend validates it"	Server must validate independently — frontend is cosmetic
"The data is from our own DB"	Stored data can be attacker-controlled (second-order injection)
"No one will guess the ID"	IDs are enumerable — ownership check is mandatory
"Unit tests pass = secure"	Unit tests never cover auth, IDOR, or injection paths

Reference Files

Load the relevant file for each phase:

File	Phase	Contents
checklist.md	1 + 2	Architecture checklist + full code audit: input, SQL/NoSQL injection, SSRF, IDOR, mass assignment, cryptography, cookies, logging
testing.md	3 + 4	API attack tests, SOC 2 audit checklist, Playwright E2E security test suite
stack-reference.md	Any	Injection risks, auth patterns, validation libraries, rate limiting, and security linting tools per stack (Node, Python, Ruby, Java, Go, PHP)

Common Mistakes

• Confirming middleware exists but not that it covers the specific new route
• Validating an ID format without checking ownership against the authenticated caller
• Logging req.body wholesale — credentials and PII end up in log files
• Assuming ORM usage means injection-free — every ORM has raw query escape hatches
• Running Phase 2 but skipping Phase 3 — clean code can still be exploited via header or method bypass

Output Formats

Phase 2 — Code Audit:

❌ CRITICAL (BLOCK MERGE): [file:line] description
⚠️  WARNING: [file:line] description
✅ SAFE: [area] verified clean
VERDICT: BLOCK / PASS

Phase 3 — API Testing:

🔴 EXPLOITABLE: [severity] description + reproduction steps
⚠️  MISSING PROTECTION: description
VERDICT: EXPLOITABLE / PASS

Phase 4 — SOC 2:

CC6 — Access Control:    PASS / GAP: [description]
CC7 — Monitoring:        PASS / GAP: [description]
CC8 — Change Mgmt:       PASS / GAP: [description]
Audit Risk Level:        LOW / MEDIUM / HIGH
Readiness Score:         [0–100]