Essentials

Security Scanning

Learn how to use AI Developer Assistant for security vulnerability scanning

Security Scanning

AI Developer Assistant provides comprehensive security scanning capabilities that help identify vulnerabilities, security issues, and potential threats in your codebase.

Basic Security Scanning

Scan All Files

# Basic security scan
ai-dev security-scan

# Scan with verbose output
ai-dev security-scan --verbose

Scan Specific Files

# Scan specific files
ai-dev security-scan --file-patterns "src/auth/**/*.ts"

# Scan multiple file types
ai-dev security-scan --file-patterns "src/**/*.{ts,js,py}"

# Scan with glob patterns
ai-dev security-scan --file-patterns "**/*.py"

Severity Levels

Filter by Severity

# Scan only critical issues
ai-dev security-scan --severity critical

# Scan high and critical issues
ai-dev security-scan --severity high,critical

# Scan all severity levels
ai-dev security-scan --severity low,medium,high,critical

Severity Levels Explained

Critical: Immediate security threats that could lead to data breaches
High: Significant security vulnerabilities that should be addressed quickly
Medium: Moderate security issues that should be addressed in the next release
Low: Minor security concerns that can be addressed during regular maintenance

Security Categories

Scan Specific Categories

# Scan for injection vulnerabilities
ai-dev security-scan --categories injection

# Scan for authentication issues
ai-dev security-scan --categories authentication,authorization

# Scan for cryptography issues
ai-dev security-scan --categories cryptography

Available Categories

injection: SQL injection, command injection, code injection
authentication: Weak authentication, missing authentication
authorization: Privilege escalation, access control issues
cryptography: Weak encryption, improper key handling
data_exposure: Sensitive data exposure, information leakage
input_validation: Missing validation, improper sanitization
dependency: Vulnerable dependencies, outdated packages
configuration: Security misconfigurations, insecure defaults
logging: Information disclosure through logs
other: Other security-related issues

Language-Specific Security Scanning

TypeScript/JavaScript

# Scan Node.js applications
ai-dev security-scan --file-patterns "server/**/*.{ts,js}"

# Scan React applications
ai-dev security-scan --file-patterns "src/**/*.{ts,tsx,js,jsx}"

# Scan with JavaScript-specific security checks
ai-dev security-scan --file-patterns "**/*.{ts,js}" --verbose

Python

# Scan Python applications
ai-dev security-scan --file-patterns "**/*.py"

# Scan Django applications
ai-dev security-scan --file-patterns "**/*.py" --categories injection,authentication

# Scan with Python-specific security checks
ai-dev security-scan --file-patterns "**/*.py" --verbose

Java

# Scan Java applications
ai-dev security-scan --file-patterns "src/**/*.java"

# Scan Spring Boot applications
ai-dev security-scan --file-patterns "src/main/java/**/*.java"

# Scan with Java-specific security checks
ai-dev security-scan --file-patterns "**/*.java" --verbose

C/C++

# Scan C/C++ applications
ai-dev security-scan --file-patterns "src/**/*.{c,cpp,h,hpp}"

# Scan with C/C++-specific security checks
ai-dev security-scan --file-patterns "**/*.{c,cpp}" --verbose

Dependency Scanning

Include Dependencies

# Scan including dependency vulnerabilities
ai-dev security-scan --include-dependencies

# Scan with dependency focus
ai-dev security-scan --include-dependencies --categories dependency

Dependency Security Checks

Outdated packages: Packages with known vulnerabilities
Weak dependencies: Dependencies with security issues
License issues: Dependencies with restrictive licenses
Supply chain: Potential supply chain attacks

Output Formats

Console Output (Default)

ai-dev security-scan --file-patterns "src/**/*.ts"

Example Output:

🔒 Security Scan: src/**/*.ts

⚠️  High Severity Issues:
   - src/auth/login.ts: Line 23 - SQL injection vulnerability
   - src/utils/encryption.ts: Line 15 - Weak encryption algorithm

🔍 Medium Severity Issues:
   - src/api/user.ts: Line 45 - Missing input validation
   - src/config/database.ts: Line 12 - Hardcoded credentials

✅ Low Severity Issues:
   - src/utils/logger.ts: Line 8 - Information disclosure in logs

Markdown Output

ai-dev security-scan --format markdown --output-path security-report.md

Example Output:

# Security Scan Report

## Summary
- **Files Scanned**: 25
- **Issues Found**: 8
- **Critical**: 0
- **High**: 2
- **Medium**: 4
- **Low**: 2

## High Severity Issues

### src/auth/login.ts
- **Line 23**: SQL injection vulnerability
  - **Description**: User input directly concatenated into SQL query
  - **Recommendation**: Use parameterized queries
  - **Category**: injection

### src/utils/encryption.ts
- **Line 15**: Weak encryption algorithm
  - **Description**: Using MD5 for password hashing
  - **Recommendation**: Use bcrypt or Argon2
  - **Category**: cryptography

JSON Output

ai-dev security-scan --format json --output-path security-report.json

Example Output:

{
  "summary": {
    "filesScanned": 25,
    "issuesFound": 8,
    "severity": {
      "critical": 0,
      "high": 2,
      "medium": 4,
      "low": 2
    }
  },
  "issues": [
    {
      "file": "src/auth/login.ts",
      "line": 23,
      "severity": "high",
      "category": "injection",
      "description": "SQL injection vulnerability",
      "recommendation": "Use parameterized queries",
      "code": "const query = `SELECT * FROM users WHERE id = ${userId}`"
    }
  ]
}

Common Security Issues

Injection Vulnerabilities

SQL Injection:

// Vulnerable code
const query = `SELECT * FROM users WHERE id = ${userId}`;

// Secure code
const query = 'SELECT * FROM users WHERE id = ?';
const result = await db.query(query, [userId]);

Command Injection:

// Vulnerable code
exec(`rm -rf ${userInput}`);

// Secure code
exec('rm', ['-rf', sanitizedUserInput]);

Authentication Issues

Weak Authentication:

// Vulnerable code
if (password === 'admin123') {
  return true;
}

// Secure code
const isValid = await bcrypt.compare(password, hashedPassword);

Missing Authentication:

// Vulnerable code
app.get('/admin', (req, res) => {
  res.send('Admin panel');
});

// Secure code
app.get('/admin', authenticate, (req, res) => {
  res.send('Admin panel');
});

Data Exposure

Sensitive Data in Logs:

// Vulnerable code
console.log('User login:', { email, password });

// Secure code
console.log('User login:', { email: email.replace(/(.{2}).*(@.*)/, '$1***$2') });

Hardcoded Credentials:

// Vulnerable code
const dbPassword = 'secret123';

// Secure code
const dbPassword = process.env.DB_PASSWORD;

Security Scanning Workflows

Pre-commit Security Check

# 1. Stage your changes
git add .

# 2. Run security scan on staged files
ai-dev security-scan --staged --severity high,critical

# 3. If no critical issues, proceed with commit
git commit -m "Your commit message"

Continuous Integration

# In CI pipeline
ai-dev security-scan --format json --output-path security-report.json

# Check for critical issues
if grep -q '"severity":"critical"' security-report.json; then
  echo "Critical security issues found"
  exit 1
fi

Regular Security Audits

# Weekly security audit
ai-dev security-scan --include-dependencies --format markdown --output-path weekly-security-report.md

# Monthly comprehensive scan
ai-dev security-scan --severity low,medium,high,critical --format json --output-path monthly-security-report.json

Advanced Security Scanning

Custom Security Rules

# Scan with custom security rules
ai-dev security-scan --custom-rules "custom-security-rules.yaml"

Integration with Security Tools

# Generate security report for other tools
ai-dev security-scan --format json --output-path security-report.json

# Import into security dashboard
curl -X POST -H "Content-Type: application/json" -d @security-report.json https://security-dashboard.com/api/reports

Compliance Scanning

# Scan for compliance requirements
ai-dev security-scan --categories injection,authentication,authorization --severity high,critical

# Generate compliance report
ai-dev security-scan --format markdown --output-path compliance-report.md

Best Practices

Regular Scanning

Scan before commits:

ai-dev security-scan --staged --severity high,critical

Scan in CI/CD:

ai-dev security-scan --format json --output-path security-report.json

Regular audits:

ai-dev security-scan --include-dependencies --format markdown --output-path security-audit.md

Focus on Critical Issues

Address critical issues immediately:

ai-dev security-scan --severity critical

Review high severity issues:

ai-dev security-scan --severity high

Plan medium severity fixes:

ai-dev security-scan --severity medium

Team Collaboration

Share security reports:

ai-dev security-scan --format markdown --output-path security-report.md

Track security metrics:

ai-dev security-scan --format json --output-path security-metrics.json

Integrate with project management:

ai-dev security-scan --format json --output-path security-issues.json

Start with basic security scanning and gradually incorporate more advanced features like dependency scanning and custom rules as your security practices mature.

Edit this pageorReport an issue

Code Review & Analysis

Learn how to use AI Developer Assistant for code review and analysis

Test Generation

Learn how to use AI Developer Assistant for automated test generation