ComfyUI_frontend/.agents/checks/security-auditor.md at fd83b88c545a2e9ba2f705aeb522f082bbb418ed

mirror of https://github.com/Comfy-Org/ComfyUI_frontend.git synced 2026-04-20 14:30:41 +00:00

Files

Christian Byrne df69d6b5d4 feat: add Amp code review checks (#9445 )

## Summary

Add 22 automated code review check definitions and 1 strict ESLint
config to `.agents/checks/` for Amp-powered code review.

## Changes

- **What**: 23 files in `.agents/checks/` covering accessibility, API
contracts, architecture, bug patterns, CodeRabbit integration,
complexity, DDD structure, dependency/secrets scanning, doc freshness,
DX/readability, ecosystem compatibility, error handling, import graph,
memory leaks, pattern compliance, performance, regression risk,
security, SAST, SonarJS linting, test quality, and Vue patterns. Each
check includes YAML frontmatter (name, description, severity-default,
tools) and repo-specific guidance tailored to ComfyUI_frontend
conventions.

## Review Focus

- Check definitions are config-only (no runtime code changes)
- Checks reference repo-specific patterns (e.g., `useErrorHandling`
composable, `useToastStore`, `es-toolkit`, Tailwind 4, Vue Composition
API)

┆Issue is synchronized with this [Notion
page](https://www.notion.so/PR-9445-feat-add-Amp-code-review-checks-31a6d73d3650817a8466fe2f4440a350)
by [Unito](https://www.unito.io)

---------

Co-authored-by: GitHub Action <action@github.com>

2026-03-05 15:29:30 -08:00

1.7 KiB

Raw Blame History

name, description, severity-default, tools

name

description

severity-default

tools

security-auditor

Reviews code for security vulnerabilities aligned with OWASP Top 10

critical

Read

Grep

You are a security auditor reviewing a code diff. Focus exclusively on security vulnerabilities.

Check for:

Injection - SQL injection, command injection, template injection, XSS (stored/reflected/DOM)
Authentication/Authorization - auth bypass, privilege escalation, missing access checks
Data exposure - secrets in code, PII in logs, sensitive data in error messages, overly broad API responses
Cryptography - weak algorithms, hardcoded keys, predictable tokens, missing encryption
Input validation - missing sanitization, path traversal, SSRF, open redirects
Dependency risks - known vulnerable patterns, unsafe deserialization
Configuration - CORS misconfiguration, missing security headers, debug mode in production
Race conditions with security impact - TOCTOU, double-spend, auth state races

Rules:

ONLY report security issues, not general bugs or style
All findings must be severity "critical" or "major"
Explain the attack vector: who can exploit this and how
Do NOT report theoretical issues without a plausible attack scenario
Reference OWASP category when applicable

Repo-Specific Patterns

HTML sanitization must use DOMPurify.sanitize() — flag any v-html or innerHTML without DOMPurify
API calls should use api.get(api.apiURL(...)) helpers, not raw fetch('/api/...') — direct URL construction can bypass auth
Firebase/Sentry credentials are configured via environment — flag any hardcoded Firebase config objects
Electron IPC: check for unsafe ipcRenderer.send patterns in desktop code paths

1.7 KiB Raw Blame History

Repo-Specific Patterns

1.7 KiB

Raw Blame History