Production Security Hardening — AI-Assisted Audit and Response

You are a senior application security engineer. Audit the following application for production readiness.

Stack: Node.js + Express + PostgreSQL + Claude API + AWS App Runner
Authentication: JWT + Google OAuth
File uploads: yes (multer, S3)
User data: yes (PII)

Generate a prioritized security checklist covering:
1. Authentication and session security
2. Input validation and injection prevention
3. File upload security
4. API security (rate limiting, key management)
5. LLM-specific risks (prompt injection, data leakage)
6. Infrastructure security (AWS IAM, secrets management)
7. Monitoring and incident response

For each item: priority (P0/P1/P2), specific test to verify, pass/fail criteria.

You are an incident response specialist. Analyze the following logs and triage this security incident.

Application logs (last 2 hours):
[paste log excerpts]

Answer:
1. What type of attack or anomaly is this? (Be specific)
2. What is the estimated impact? (data accessed, accounts affected)
3. Is the attack ongoing or historical?
4. What is the immediate containment action? (be specific to our stack)
5. What forensic evidence should we preserve right now?
6. Draft a brief internal incident notification (for engineering team)
7. Draft a user notification (if PII was potentially exposed)

import helmet from 'helmet';
import rateLimit from 'express-rate-limit';

// Security headers
app.use(helmet({
  contentSecurityPolicy: {
    directives: {
      defaultSrc: ["'self'"],
      scriptSrc: ["'self'"],
      styleSrc: ["'self'", "'unsafe-inline'"],
      imgSrc: ["'self'", 'data:', 'https:'],
      connectSrc: ["'self'", 'https://api.anthropic.com'],
    }
  },
  hsts: { maxAge: 31536000, includeSubDomains: true, preload: true },
  noSniff: true,
  xssFilter: true,
  referrerPolicy: { policy: 'strict-origin-when-cross-origin' }
}));

// Rate limiting by endpoint sensitivity
const authLimiter = rateLimit({ windowMs: 15 * 60 * 1000, max: 10, message: 'Too many auth attempts' });
const apiLimiter = rateLimit({ windowMs: 60 * 1000, max: 100 });

app.use('/auth', authLimiter);
app.use('/api', apiLimiter);

# npm audit — check for known vulnerabilities
npm audit
npm audit --fix  # auto-fix compatible updates

# Generate audit report
npm audit --json > security-audit.json

# Snyk (more comprehensive)
npm install -g snyk
snyk auth
snyk test
snyk monitor  # continuous monitoring

# Add to CI/CD (GitHub Actions)
# - name: Security Audit
#   run: npm audit --audit-level high && npx snyk test