Name: audit-security-nist
Author: xoate0100

Prompt file imported from xoate0100/CutRatesLawnWebSite (.cursor/commands/audit-security-nist.md). Copyright stays with the author.

/audit-security-nist — NIST-aligned security review

Follow the shared flow in _skeleton.md. Security uses its own scoring: rate each finding with a CVSS v4.0/3.1 vector AND an SP 800-30 likelihood × impact rating, adjusted for real deployment context; reconcile and prefer the context-adjusted result for priority.

Governing standards: CSF 2.0 (Govern/Identify/Protect/Detect/Respond/Recover), SP 800-53 control families, SP 800-115 method (examine/interview/test), SP 800-63B identity/AAL, SP 800-218 SSDF secure SDLC, SP 800-30 risk.

Rules of engagement (do first)

Confirm authorized scope, target env (staging unless prod is authorized in writing), test accounts per role, and non-destructive constraint. Any live secret/PII found = P0, redact value, record location only.

Inventory (IDENTIFY)

Routes/APIs + auth requirement each; roles + trust boundaries; data inventory + classification (public/internal/PII/secret/regulated); attack surface reachable unauthenticated, per-role, and via direct API bypassing the UI.

Checks (PROTECT/DETECT) — map each finding to control IDs + CWE

IA / 800-63B — AAL enforced; credential storage; reset/recovery + account enumeration; MFA + bypass; brute-force/lockout; OAuth redirect/state/PKCE.
Session — cookie flags (HttpOnly/Secure/SameSite); fixation; rotation on privilege change; idle/absolute timeout; server-side logout; expired/revoked token replay.
Authorization (highest yield) — vertical escalation per role; horizontal IDOR on every object id via UI and direct API; server-side enforcement at API/domain layer not just UI; cross-user/tenant isolation at the query layer (Supabase RLS actually applied, not assumed).
API + input — authn/authz/method per endpoint; injection (SQL/NoSQL/cmd/ template/deserialization); mass assignment; boundary/length; rate limits.
File upload — server-side content validation, size, path traversal, stored location executability, safe content-type on serve.
Crypto/data — TLS+HSTS; at-rest protection; secure randomness; no homerolled.
Secrets/config/errors — scan repo, client bundles, source maps, API responses, error output for keys/tokens; debug endpoints; stack/version leak; security headers (CSP, X-Content-Type-Options, frame-ancestors).
Logging/detect (AU) — security events logged with context, without secrets/PII.
Business logic — race/TOCTOU (double-spend, limit bypass); duplicate/replay; partial-success/dependency-failure integrity across layers.
Supply chain (SR/SSDF) — deps vs NVD/CVE; lockfile + build integrity.

Release gate

Do not declare security-ready while any P0/P1 is open, any auth/authz boundary is untested (inferred ≠ tested), or any check area lacks a recorded method/result.

Install audit-security-nist and it becomes one more candidate the router can pick - when it fits.

A listing is a routing target with a manifest: what it does, which domains it covers, what it costs and who publishes it. Once installed it sits beside your own models and tools, is scored like any other candidate for each request, and shows up in the trace when it wins. Ratings come from workspaces that installed it, one per account.

# /audit-security-nist — NIST-aligned security review Follow the shared flow in `_skeleton.md`. Security uses its own scoring: rate each finding with a **CVSS v4.0/3.1 vector** AND an **SP 800-30 likelihood × impact** rating, adjusted for real deployment context; reconcile and prefer the context-adjusted result for priority. Governing standards: **CSF 2.0** (Govern/Identify/Protect/Detect/Respond/Recover), **SP 800-53** control families, **SP 800-115** method (examine/interview/**test**), **SP 800-63B** identity/AAL, **SP 800-218 SSDF** secure SDLC, **SP 800-30** risk. ## Rules of engagement (do first) Confirm authorized scope, target env (**staging unless prod is authorized in writing**), test accounts per role, and non-destructive constraint. Any live secret/PII found = P0, redact value, record location only. ## Inventory (IDENTIFY) Routes/APIs + auth requirement each; roles + trust boundaries; data inventory + classification (public/internal/PII/secret/regulated); attack surface reachable unauthenticated, per-role, and via direct API bypassing the UI. ## Checks (PROTECT/DETECT) — map each finding to control IDs + CWE - **IA / 800-63B** — AAL enforced; credential storage; reset/recovery + account enumeration; MFA + bypass; brute-force/lockout; OAuth redirect/state/PKCE. - **Session** — cookie flags (HttpOnly/Secure/SameSite); fixation; rotation on privilege change; idle/absolute timeout; server-side logout; expired/revoked token replay. - **Authorization (highest yield)** — vertical escalation per role; horizontal **IDOR** on every object id via UI *and* direct API; server-side enforcement at API/domain layer not just UI; cross-user/tenant isolation at the query layer (Supabase RLS actually applied, not assumed). - **API + input** — authn/authz/method per endpoint; injection (SQL/NoSQL/cmd/ template/deserialization); mass assignment; boundary/length; rate limits. - **File upload** — server-side content validation, size, path traversal, stored location executability, safe content-type on serve. - **Crypto/data** — TLS+HSTS; at-rest protection; secure randomness; no homerolled. - **Secrets/config/errors** — scan repo, client bundles, source maps, API responses, error output for keys/tokens; debug endpoints; stack/version leak; security headers (CSP, X-Content-Type-Options, frame-ancestors). - **Logging/detect (AU)** — security events logged with context, without secrets/PII. - **Business logic** — race/TOCTOU (double-spend, limit bypass); duplicate/replay; partial-success/dependency-failure integrity across layers. - **Supply chain (SR/SSDF)** — deps vs NVD/CVE; lockfile + build integrity. ## Release gate Do not declare security-ready while any P0/P1 is open, any auth/authz boundary is untested (inferred ≠ tested), or any check area lacks a recorded method/result.

{ "prompt": "# /audit-security-nist — NIST-aligned security review\n\nFollow the shared flow in `_skeleton.md`. Security uses its own scoring: rate each\nfinding with a **CVSS v4.0/3.1 vector** AND an **SP 800-30 likelihood × impact**\nrating, adjusted for real deployment context; reconcile and prefer the\ncontext-adjusted result for priority.\n\nGoverning standards: **CSF 2.0** (Govern/Identify/Protect/Detect/Respond/Recover),\n**SP 800-53** control families, **SP 800-115** method (examine/interview/**test**),\n**SP 800-63B** identity/AAL, **SP 800-218 SSDF** secure SDLC, **SP 800-30** risk.\n\n## Rules of engagement (do first)\nConfirm authorized scope, target env (**staging unless prod is authorized in\nwriting**), test accounts per role, and non-destructive constraint. Any live\nsecret/PII found = P0, redact value, record location only.\n\n## Inventory (IDENTIFY)\nRoutes/APIs + auth requirement each; roles + trust boundaries; data inventory +\nclassification (public/internal/PII/secret/regulated); attack surface reachable\nunauthenticated, per-role, and via direct API bypassing the UI.\n\n## Checks (PROTECT/DETECT) — map each finding to control IDs + CWE\n- **IA / 800-63B** — AAL enforced; credential storage; reset/recovery + account\n enumeration; MFA + bypass; brute-force/lockout; OAuth redirect/state/PKCE.\n- **Session** — cookie flags (HttpOnly/Secure/SameSite); fixation; rotation on\n privilege change; idle/absolute timeout; server-side logout; expired/revoked\n token replay.\n- **Authorization (highest yield)** — vertical escalation per role; horizontal\n **IDOR** on every object id via UI *and* direct API; server-side enforcement at\n API/domain layer not just UI; cross-user/tenant isolation at the query layer\n (Supabase RLS actually applied, not assumed).\n- **API + input** — authn/authz/method per endpoint; injection (SQL/NoSQL/cmd/\n template/deserialization); mass assignment; boundary/length; rate limits.\n- **File upload** — server-side content validation, size, path traversal, stored\n location executability, safe content-type on serve.\n- **Crypto/data** — TLS+HSTS; at-rest protection; secure randomness; no homerolled.\n- **Secrets/config/errors** — scan repo, client bundles, source maps, API\n responses, error output for keys/tokens; debug endpoints; stack/version leak;\n security headers (CSP, X-Content-Type-Options, frame-ancestors).\n- **Logging/detect (AU)** — security events logged with context, without secrets/PII.\n- **Business logic** — race/TOCTOU (double-spend, limit bypass); duplicate/replay;\n partial-success/dependency-failure integrity across layers.\n- **Supply chain (SR/SSDF)** — deps vs NVD/CVE; lockfile + build integrity.\n\n## Release gate\nDo not declare security-ready while any P0/P1 is open, any auth/authz boundary is\nuntested (inferred ≠ tested), or any check area lacks a recorded method/result.", "variables": [], "notes": "NIST-aligned application security review (CSF 2.0 / 800-53 / 800-63B / 800-218 / 800-30 + CVSS) Arguments: [--fix] [--scope <route|path>].", "metadata": { "source": { "provider": "github-cursor-commands", "repository": "https://github.com/xoate0100/CutRatesLawnWebSite", "path": ".cursor/commands/audit-security-nist.md", "ref": "5a395be61c1fcd2b222549ecaa64589e9f0bc21b", "url": "https://github.com/xoate0100/CutRatesLawnWebSite/blob/5a395be61c1fcd2b222549ecaa64589e9f0bc21b/.cursor/commands/audit-security-nist.md", "key": "xoate0100/CutRatesLawnWebSite/.cursor/commands/audit-security-nist.md" } } }

audit-security-nist

About