Claude Code Security — Masih Perlukah Pentest? Analisis Lengkap AI Security Assessment

# Pastikan Claude Code versi terbaru
$ npm update -g @anthropic-ai/claude-code

# Masuk ke project directory
$ cd ~/projects/makanyuk-app

# Jalankan security review
$ claude /security-review

🛡️ Claude Code Security — Scanning codebase...
  Reading project structure... 247 files, 38,420 lines
  Tracing data flows across modules...
  Analyzing authentication & authorization patterns...
  Checking dependency vulnerabilities...
  Running adversarial verification pass...

═══════════════════════════════════════════════════
  SECURITY REVIEW RESULTS — makanyuk-app
  Scanned: 247 files | Duration: 4m 32s
═══════════════════════════════════════════════════

CRITICAL (2 findings)

  [CCS-001] SQL Injection in User Search
  File: server/routes/restaurant.routes.ts:47
  Confidence: 95%
  Description: User input from query parameter 'q' is
  concatenated directly into SQL query without
  parameterization. The Prisma raw query at line 47
  bypasses Prisma's built-in parameterization.
  
  Vulnerable code:
    const results = await prisma.$queryRawUnsafe(
      `SELECT * FROM restaurants WHERE name LIKE '%${q}%'`
    )
  
  Suggested fix:
    const results = await prisma.$queryRaw`
      SELECT * FROM restaurants WHERE name LIKE ${`%${q}%`}
    `

  [CCS-002] Broken Access Control — Order Data Exposure
  File: server/routes/order.routes.ts:89
  Confidence: 88%
  Description: GET /api/orders/:id endpoint does not
  verify that the requesting user owns the order.
  Any authenticated user can access any order by ID
  (IDOR vulnerability). Data flow traced from
  auth.middleware.ts → order.routes.ts → no ownership check.
  
  Suggested fix: Add ownership verification
    const order = await prisma.order.findUnique({
      where: { id: params.id, customerId: req.user.id }
    })

HIGH (3 findings)

  [CCS-003] JWT Secret in Source Code
  File: server/middleware/auth.middleware.ts:12
  Confidence: 99%
  jwt.verify(token, "makanyuk-secret-2026")
  Fix: Move to environment variable: process.env.JWT_SECRET

  [CCS-004] Missing Rate Limiting on Auth Endpoint
  File: server/routes/auth.routes.ts:23
  Confidence: 92%
  POST /api/auth/login has no rate limiting.
  Fix: Add express-rate-limit middleware (5 req/min/IP)

  [CCS-005] Session Cookie Missing Secure Flags
  File: server/index.ts:34
  Confidence: 97%
  Fix: Set httpOnly: true, secure: true, sameSite: 'strict'

MEDIUM (4 findings)
  [CCS-006] Missing CSP Header — Confidence: 90%
  [CCS-007] Verbose Error Messages in Production — Conf: 85%
  [CCS-008] Outdated dependency: express@4.18.2 — Conf: 99%
  [CCS-009] No input validation on file upload — Conf: 78%

LOW (2 findings)
  [CCS-010] X-Powered-By header exposed — Confidence: 99%
  [CCS-011] Console.log with user data — Confidence: 72%

═══════════════════════════════════════════════════
  SUMMARY: 2 Critical | 3 High | 4 Medium | 2 Low
  Action: Review and approve patches above
═══════════════════════════════════════════════════

Apply fix for CCS-001? [y/n/skip all]

name: Claude Security Review
on:
  pull_request:
    types: [opened, synchronize]

jobs:
  security-review:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4

      - uses: anthropics/claude-code-security-review@v1
        with:
          anthropic_api_key: ${{ secrets.ANTHROPIC_API_KEY }}
          model: "claude-opus-4-6"
          # Options: scan diff only (faster) or full codebase
          scan_mode: "diff"  # or "full"
          severity_threshold: "medium"
          auto_comment: true