BridgeSecurity - GitLite

KO | EN

gitlite — search

#developer-tools #list #reactjs #kubernetes #cpp #macos #video #llm #css #redis

BridgeSecurity

(★ 26)

Find vulnerabilities. Ship secure. — Senior security-engineer skill for AI coding agents. OWASP Top 10, CWE Top 25, secrets detection, IaC + CI hardening, and a read-only auditor subagent. MIT.

File Explorer

ZIP Download

- plugin.json
- security-auditor.md
- scan.sh
- - SKILL.md
- - SKILL.md
.gitignore
CHANGELOG.md
CONTRIBUTING.md
LICENSE
README.md

# Use via CDN

jsDelivr

jsDelivr serves any public GitHub repository as a CDN with zero setup. Pick a version and a file to get a ready-to-paste link and snippet.

Version

File

Link

Example

Command Glossary

Commands referenced in this DOCs, explained below.

🔍

`claude`

View Details ▼

An agent-based coding tool that understands your code base and helps you code faster through natural language commands.

claude prompt

Execute with prompt:

claude update

Update `claude`:

claude mcp list

Get the list of specified MCP servers:

🔍

`eval`

View Details ▼

Execute arguments as a single command in the current shell and return its result.

eval "{{echo foo}}"

Call `echo` with the "foo" argument:

eval "{{foo=bar}}"

Set a variable in the current shell:

🔍

`query`

View Details ▼

Display information about user sessions and process.

query session

Display all user sessions:

query session /server:{{hostname}}

Display the current user sessions on a remote computer:

query user

Display logged in users:

// repository documentation

Was this content helpful?

★ 0 (0 ratings)

<p align="center">
  <strong>BridgeSecurity</strong>
</p>

<h3 align="center">Find vulnerabilities. Ship secure.</h3>

<p align="center">
  A Claude Code plugin from <a href="https://www.bridgemind.ai">BridgeMind</a> that gives your AI agents the instincts of a senior application security engineer.<br/>
  Stop shipping classic vulnerabilities — start shipping production-secure code.
</p>

<p align="center">
  <a href="LICENSE"><img src="https://img.shields.io/badge/license-MIT-blue.svg" alt="MIT License" /></a>
  <a href="https://www.bridgemind.ai/discord"><img src="https://img.shields.io/badge/Discord-builders-5865F2?logo=discord&logoColor=white" alt="Discord" /></a>
</p>

---

## Why BridgeSecurity?

AI coding agents write functional code, but they keep shipping the same classic vulnerabilities — SQL injection, XSS, IDOR, hardcoded secrets, missing auth on Server Actions, public S3 buckets, `pull_request_target` with checkout-of-fork-code. The bugs that have headlined CVEs for fifteen years.

**BridgeSecurity fixes this.** It's a set of detection patterns, vulnerability taxonomies, threat-modeling discipline, and a specialized auditor agent that teach your AI teammates to **think like a senior security engineer** — find the trust boundary, match input to sink, check auth on every state-changing path, treat every secret as already leaked, fail closed.

### The Bugs It Catches

- **Injection** — SQLi, NoSQLi, command, code, template, XSS, LDAP, XPath
- **Broken Access Control** — IDOR, BOLA, BOPLA, missing auth, mass assignment, Server Action authz gaps, `x-middleware-subrequest` bypass class
- **Cryptographic Failures** — MD5/SHA1, `Math.random()` for tokens, ECB mode, hardcoded keys, JWT `alg: none`, HS256/RS256 confusion, `===` for HMAC compare
- **SSRF** — including private-IP / cloud-metadata / `file://` / TOCTOU
- **Path Traversal** — `path.join` without prefix-check, `send_file` with raw input
- **Insecure Deserialization** — `pickle.loads`, `yaml.load`, `ObjectInputStream`, `vm2`
- **Hardcoded Secrets** — AWS, GitHub, Stripe, OpenAI, Anthropic, Slack, JWTs, private keys (25+ patterns)
- **Cloud Misconfig** — public S3, IAM `*:*`, `0.0.0.0/0:22`, IMDSv1, missing encryption
- **Container / k8s** — `privileged: true`, `runAsUser: 0`, `hostNetwork`, `/var/run/docker.sock` mount, `image:latest`
- **CI/CD** — `pull_request_target` + checkout-fork-code, mutable Action tags (CVE-2025-30066 class), shell-injection via PR title
- **Auth flaws** — JWT in localStorage, no MFA, missing rate limit on login, predictable reset tokens
- **Open Redirect** — `//evil.com` bypass class
- **Markdown exfil** — image URLs constructed from secrets (EchoLeak class)
- **LLM-specific** — output-to-eval, excessive agency, secrets in system prompt

---

## What's Inside

| Component | Type | What It Does |
|-----------|------|-------------|
| **`bridgesecurity`** | Skill | Core security discipline — auto-loaded when your agent reads, writes, or reviews code. Five Disciplines, threat-model checklist, detection cheat-sheet. |
| **`security-audit`** | Skill | Slash-command audit. Scans a file/dir/PR/repo for vulnerabilities, returns severity-ranked report with CWE/OWASP mapping. |
| **`security-auditor`** | Agent | Read-only senior security engineer subagent. Cannot write, edit, or delete. Walks every file with the OWASP Top 10 + CWE Top 25 + threat model. |

### Reference Documentation

The skill ships with eight deep reference docs (~50 pages of practitioner-grade content):

- **vulnerability-taxonomies.md** — OWASP Top 10 (2021), API Top 10 (2023), Mobile Top 10 (2024), LLM Top 10 (2025), CWE Top 25 (2024), CISA KEV recurring classes, DBIR top vectors
- **language-patterns.md** — JS/TS, Python, Go, Rust, Java/Spring, Ruby/Rails, PHP — vulnerable + fixed code pairs, per-ORM SQLi reference
- **frontend-patterns.md** — React, Next.js (Server Actions, middleware, hydration), Vue, Svelte, browser specifics
- **infrastructure-patterns.md** — AWS, GCP, Azure, Docker, Kubernetes, Terraform, GitHub Actions, GitLab CI
- **secrets-patterns.md** — regex catalog for 25+ secret types
- **case-studies.md** — Log4Shell, Spring4Shell, MOVEit, XZ backdoor, Polyfill.io, Snowflake, Ivanti, regreSSHion, Next.js CVE-2025-29927, tj-actions supply chain, recent agent CVEs
- **tooling.md** — Semgrep, CodeQL, Snyk, Trivy, Gitleaks, OSV, govulncheck, Brakeman, Checkov, kube-bench, MobSF
- **threat-modeling.md** — the full 10-question discipline

---

## Install

### As a Claude Code plugin

```bash
claude plugin install bridgesecurity@bridgemind-plugins
```

### Or copy the skills manually

```bash
mkdir -p .claude/skills .claude/agents
cp -r skills/bridgesecurity .claude/skills/
cp -r skills/security-audit .claude/skills/
cp agents/security-auditor.md .claude/agents/
```

```bash
# Personal / global
mkdir -p ~/.claude/skills ~/.claude/agents
cp -r skills/bridgesecurity ~/.claude/skills/
cp -r skills/security-audit ~/.claude/skills/
cp agents/security-auditor.md ~/.claude/agents/
```

---

## How It Works

### The Five Disciplines

Once installed, the `bridgesecurity` skill activates whenever your agent reads, writes, or reviews code. Your agent now thinks like a senior:

1. **Find the trust boundaries** — every place untrusted data crosses into trusted code.
2. **Match input to sink** — every `(source, sink)` pair is a potential vulnerability.
3. **Auth on every state-changing path** — authentication + authorization (ownership, not just role) + input validation.
4. **Secrets are already leaked** — assume rotation as default, plan for it.
5. **Fail closed, log loudly, blast-radius small** — default deny, sanitized errors, audit logs, network/IAM segmentation.

### The 10-Question Threat Model

Before declaring code "secure":

1. Trust boundaries — where does data cross?
2. AuthN/AuthZ — server-side, ownership-checked?
3. Input validation — schema at the boundary?
4. Output encoding — correct context?
5. Secrets — safe storage + rotation?
6. Failure mode — fail closed?
7. Blast radius — what falls if owned?
8. Supply chain — pinned + audited?
9. Logging — security events captured? PII redacted?
10. Replay protection — idempotency, nonces, CSRF, rate limits?

If any answer is "I don't know" — the code is **not** cleared.

### Audit Mode

```
> /security-audit src/api/users.ts

> /security-audit https://github.com/owner/repo/pull/123

> /security-audit ./terraform/

> /security-audit "all server actions in this app"
```

The `security-auditor` agent walks the target, applies all 20 audit categories, and produces a severity-ranked report with:
- **File:line** — exact location
- **Class** — vulnerability category
- **CWE / OWASP** — canonical IDs
- **Code** — verbatim vulnerable snippet
- **Exploit scenario** — concrete, not generic
- **Fix** — patched code
- **References** — links to CWE, OWASP, BridgeSecurity references

---

## Why "BridgeSecurity"?

Direct. Functional. Pairs with [BridgeWard](https://github.com/bridge-mind/BridgeWard) — *Trust nothing. Ship safely.* — for prompt-injection defense:

- **BridgeWard** protects your **agent** from prompt injection in untrusted content.
- **BridgeSecurity** protects your **code** from classic application vulnerabilities.

Both rooted in the BridgeMind brand line: **Ship with agents.** The security corollary: **Find vulnerabilities. Ship secure.**

---

## When to Use BridgeSecurity

You should install BridgeSecurity if your agent:

- Writes any production code
- Reviews PRs or diffs
- Generates infrastructure-as-code (Terraform, Kubernetes, Dockerfiles)
- Edits CI/CD configurations (GitHub Actions, GitLab CI)
- Refactors authentication / authorization / payments code
- Handles user input on any code path
- Writes Server Actions, RPC handlers, API endpoints
- Touches anything with `eval`, `exec`, `query`, `fetch`, `redirect`, file paths, or secrets

If your agent only writes pure functions and unit tests, you may not need this. **Everyone else does.**

---

## Project Layout

```
BridgeSecurity/
├── .claude-plugin/
│   └── plugin.json
├── skills/
│   ├── bridgesecurity/
│   │   ├── SKILL.md
│   │   └── references/
│   │       ├── vulnerability-taxonomies.md
│   │       ├── language-patterns.md
│   │       ├── frontend-patterns.md
│   │       ├── infrastructure-patterns.md
│   │       ├── secrets-patterns.md
│   │       ├── case-studies.md
│   │       ├── tooling.md
│   │       └── threat-modeling.md
│   └── security-audit/
│       └── SKILL.md
├── agents/
│   └── security-auditor.md
└── scripts/
    └── scan.sh
```

---

## Compatibility

BridgeSecurity uses the standard **SKILL.md / agent** package format supported by 30+ AI coding tools.

| Tool | Skills | Subagent | Notes |
|------|--------|----------|-------|
| Claude Code | ✅ | ✅ | Full plugin support |
| Cursor | ✅ | — | Drop into `.cursor/skills/` |
| Windsurf | ✅ | — | Skill format |
| OpenAI Codex | ✅ | — | Skill format |
| Gemini CLI | ✅ | — | Skill format |
| Cline / Roo Code | ✅ | — | Skill format |
| GitHub Copilot | ✅ | — | Via `.github/copilot-instructions.md` reference |
| Continue.dev | ✅ | — | Skill format |
| Goose | ✅ | — | Skill format |

---

## What BridgeSecurity Is Not

- **Not a SAST tool.** It's a *thinking* skill. Pair it with Semgrep / CodeQL / Snyk / Trivy — the skill knows how to invoke them and synthesize output.
- **Not a guarantee.** Security is layered. This skill makes your agent better; it doesn't make your code invulnerable.
- **Not a replacement for human review** on high-stakes flows (payments, auth, crypto, IAM).
- **Not a runtime defense.** It catches issues at code-time. WAFs, sandboxes, and observability live elsewhere.

It is one layer in your stack. Layer it with: SAST in CI, dependency scanning, secret scanning, container scanning, IaC scanning, DAST, runtime observability, and human security review for high-stakes changes.

---

## Companion Skills

- **[BridgeWard](https://github.com/bridge-mind/BridgeWard)** — Prompt-injection defense. *Trust nothing. Ship safely.*
- **[BridgeUI](https://github.com/bridge-mind/bridgeui)** — Senior frontend design instincts.
- **[BridgeRemotion](https://github.com/bridge-mind/BridgeRemotion)** — Remotion video-engineering expertise.
- **[BridgeMotion](https://github.com/bridge-mind/bridgemotion)** — MIT-licensed React video framework.

---

## Authoritative References

This skill synthesizes guidance from:

- [OWASP Top 10 (2021)](https://owasp.org/Top10/)
- [OWASP API Security Top 10 (2023)](https://owasp.org/API-Security/editions/2023/en/0x11-t10/)
- [OWASP Mobile Top 10 (2024)](https://owasp.org/www-project-mobile-top-10/)
- [OWASP LLM Top 10 (2025)](https://genai.owasp.org/llm-top-10/)
- [CWE Top 25 (2024)](https://cwe.mitre.org/top25/archive/2024/2024_cwe_top25.html)
- [CISA Known Exploited Vulnerabilities](https://www.cisa.gov/known-exploited-vulnerabilities-catalog)
- [Verizon DBIR](https://www.verizon.com/business/resources/reports/dbir/)
- [NIST NVD](https://nvd.nist.gov/)
- [CIS Benchmarks](https://www.cisecurity.org/cis-benchmarks/)
- [NSA/CISA Kubernetes Hardening Guide v1.2](https://media.defense.gov/2022/Aug/29/2003066362/-1/-1/0/CTR_KUBERNETES_HARDENING_GUIDANCE_1.2_20220829.PDF)
- [GitHub Actions Security Hardening](https://docs.github.com/en/actions/security-guides/security-hardening-for-github-actions)
- [OWASP Cheat Sheet Series](https://cheatsheetseries.owasp.org/)

---

## Contributing

PRs welcome — especially for new vulnerability patterns, fresh case studies, and per-language additions. See [CONTRIBUTING.md](CONTRIBUTING.md).

When adding a new pattern: include a real-world citation (CVE, writeup, or CVSS score). When adding a new case study: name the vendor, date, vector, and remediation.

---

## License

MIT. See [LICENSE](LICENSE). True open source. No license traps. Ship freely.

---

## About BridgeMind

BridgeMind is an **agentic organization** — AI agents are teammates, not tools. We build open-source plugins for the **builder** community to ship faster through **vibe coding** — and ship securely.

---

*Built by BridgeMind. Find vulnerabilities. Ship secure.*