Demo 24: Red Team Security

/redteam scan

Red Team Security Scan
======================
Project: /path/to/your/project
Scanning 342 source files...

Phase 1/4: Static analysis.............. done (12.3s)
Phase 2/4: OWASP Top 10 checks......... done (8.7s)
Phase 3/4: Dependency audit............. done (5.2s)
Phase 4/4: AI adversarial analysis...... done (15.1s)

Scan complete in 41.3s

Results:
  CRITICAL:  1
  HIGH:      3
  MEDIUM:    7
  LOW:       12
  INFO:      5

Total findings: 28
Report saved to: .vibecli/security/scan-2026-03-13.json

/redteam report

=== CRITICAL (1) ===

[C-001] SQL Injection in user query
  File: src/db/queries.rs:45
  Type: OWASP A03:2021 - Injection
  Code:
    let query = format!("SELECT * FROM users WHERE id = '{}'", user_input);
  Risk: Attacker can execute arbitrary SQL via crafted user_input
  Fix:  Use parameterized queries instead of string interpolation

=== HIGH (3) ===

[H-001] Path Traversal in file download endpoint
  File: src/api/files.rs:78
  Type: OWASP A01:2021 - Broken Access Control
  Code:
    let path = format!("uploads/{}", request.filename);
    let content = fs::read_to_string(path)?;
  Risk: Attacker can read arbitrary files via "../../../etc/passwd"
  Fix:  Canonicalize path and verify it stays within uploads directory

[H-002] Missing authentication on admin endpoint
  File: src/api/admin.rs:12
  Type: OWASP A07:2021 - Identification and Authentication Failures
  Code:
    #[get("/admin/users")]
    async fn list_all_users(db: &State<Db>) -> Json<Vec<User>> {
  Risk: Any unauthenticated user can list all user records
  Fix:  Add authentication guard middleware

[H-003] Hardcoded secret key
  File: src/config.rs:23
  Type: OWASP A02:2021 - Cryptographic Failures
  Code:
    const JWT_SECRET: &str = "super-secret-key-change-me";
  Risk: Known secret enables token forgery
  Fix:  Load from environment variable or secrets manager

=== MEDIUM (7) ===

[M-001] Cross-Site Scripting (XSS) in template rendering
  File: src/templates/user_profile.rs:34
  Type: OWASP A03:2021 - Injection
  ...

[M-002] Insecure deserialization of user input
  File: src/api/webhooks.rs:56
  Type: OWASP A08:2021 - Software and Data Integrity Failures
  ...

(and 5 more medium findings)

=== LOW (12) ===
(summary of low-severity findings)

=== INFO (5) ===
(informational notes about security best practices)

/redteam scan --type injection

Scanning for injection vulnerabilities...
  Checked: SQL injection, NoSQL injection, Command injection, LDAP injection, XPath injection

Findings:
  [C-001] SQL Injection in src/db/queries.rs:45
  [M-001] XSS in src/templates/user_profile.rs:34
  [M-005] Command injection in src/utils/shell.rs:22

3 findings (1 critical, 2 medium)

/redteam scan --type auth          # Authentication and authorization issues
/redteam scan --type crypto        # Cryptographic failures
/redteam scan --type dependencies  # Vulnerable dependencies
/redteam scan --type config        # Security misconfiguration
/redteam scan --type xss           # Cross-site scripting
/redteam scan --type path-traversal  # Path traversal attacks

/redteam audit --deps

Dependency Vulnerability Audit
==============================

Rust dependencies (Cargo.lock):
  [HIGH] serde_yaml 0.8.23 - CVE-2024-XXXX: Arbitrary code execution
    Fix: Upgrade to serde_yaml 0.9.0+
  [MEDIUM] hyper 0.14.18 - CVE-2024-YYYY: Request smuggling
    Fix: Upgrade to hyper 0.14.27+
  [LOW] regex 1.5.4 - CVE-2023-ZZZZ: ReDoS via crafted pattern
    Fix: Upgrade to regex 1.7.0+

Node.js dependencies (package-lock.json):
  [HIGH] jsonwebtoken 8.5.1 - CVE-2024-AAAA: Algorithm confusion
    Fix: Upgrade to jsonwebtoken 9.0.0+
  [MEDIUM] express 4.17.1 - CVE-2024-BBBB: Open redirect
    Fix: Upgrade to express 4.18.2+

Total: 5 vulnerable dependencies (2 high, 2 medium, 1 low)

/redteam scan --ai-deep

AI Adversarial Analysis
=======================

[AI-001] Authentication bypass via race condition
  File: src/middleware/auth.rs:67
  Attack: Two concurrent requests with an expiring token could both pass
         validation if the token check and the database lookup are not atomic.
  Impact: Temporary authentication bypass
  Recommendation: Use atomic check-and-load, or accept slight timing window
  Confidence: Medium

[AI-002] Information leakage via error messages
  File: src/api/handlers.rs:120
  Attack: Database errors are returned verbatim to the client, revealing
         table names, column names, and query structure.
  Impact: Aids attacker reconnaissance
  Recommendation: Map internal errors to generic user-facing messages
  Confidence: High

[AI-003] Denial of service via unbounded pagination
  File: src/api/list.rs:45
  Attack: GET /api/items?limit=999999999 returns the entire database
  Impact: Memory exhaustion, service disruption
  Recommendation: Enforce maximum page size (e.g., 100)
  Confidence: High

/redteam fix C-001

Fixing [C-001] SQL Injection in src/db/queries.rs:45

Before:
  let query = format!("SELECT * FROM users WHERE id = '{}'", user_input);
  let result = db.execute(&query)?;

After:
  let result = db.execute(
      "SELECT * FROM users WHERE id = $1",
      &[&user_input],
  )?;

Applied fix to src/db/queries.rs
Running tests... 142 passed, 0 failed

/redteam fix --severity critical,high

Fixing 4 findings...
  [C-001] SQL Injection       -> Fixed (parameterized query)
  [H-001] Path Traversal      -> Fixed (path canonicalization + boundary check)
  [H-002] Missing Auth         -> Fixed (added auth guard middleware)
  [H-003] Hardcoded Secret    -> Fixed (read from env var VIBECODY_JWT_SECRET)

4 fixes applied. Running tests... 142 passed, 0 failed
Re-scanning... 0 critical, 0 high remaining

/redteam report --format markdown --output security-report.md

Security report generated: security-report.md
  Scan date: 2026-03-13
  Total findings: 28 (before fixes), 21 (after fixes)
  Fixed: 7 (1 critical, 3 high, 3 medium)
  Remaining: 21 (0 critical, 0 high, 4 medium, 12 low, 5 info)
  OWASP coverage: 10/10 categories checked