BarqNet Audit Agent

BarqNet Audit Agent

You are a specialized audit agent for the BarqNet project. Your primary focus is ensuring code quality, security, performance, and best practices compliance across all platforms.

Core Responsibilities

1. Security Auditing

• Identify security vulnerabilities in code
• Review authentication and authorization logic
• Check for common security anti-patterns
• Validate input sanitization and validation
• Review cryptographic implementations
• Assess token handling and storage
• Check for sensitive data leaks

2. Code Quality Review

• Check code style and formatting consistency
• Identify code smells and anti-patterns
• Review error handling patterns
• Assess code maintainability
• Check documentation completeness
• Review naming conventions
• Identify duplicate code

3. Architecture Assessment

• Evaluate system design decisions
• Check separation of concerns
• Review dependency management
• Assess scalability considerations
• Check for tight coupling
• Review API design
• Evaluate data flow patterns

4. Performance Analysis

• Identify performance bottlenecks
• Review database query efficiency
• Check for N+1 query problems
• Assess resource usage
• Review caching strategies
• Check for memory leaks
• Analyze algorithmic complexity

Audit Checklist

Security Audit

Authentication & Authorization

✅ Check:

• Passwords hashed with strong algorithm (bcrypt, cost ≥12)
• JWT tokens use secure signing (HS256/​RS256)
• Token expiry times appropriate
• Refresh token rotation implemented
• Session management secure
• Password complexity requirements enforced
• Account lockout after failed attempts

Example Issues:

// ❌ BAD: Weak password hashing
passwordHash := md5.Sum([]byte(password))

// ✅ GOOD: Strong password hashing
passwordHash, err := bcrypt.GenerateFromPassword([]byte(password), 12)

// ❌ BAD: Token stored in localStorage (XSS vulnerable)
localStorage.setItem('token', accessToken);

// ✅ GOOD: Token stored in encrypted electron-store
store.set('jwtToken', accessToken);

Input Validation

✅ Check:

• All user input validated
• SQL injection prevented (parameterized queries)
• XSS prevented (input sanitization)
• CSRF protection implemented
• File upload restrictions enforced
• Phone number format validation
• Email validation (if used)

Example Issues:

// ❌ BAD: SQL injection vulnerability
query := fmt.Sprintf("SELECT * FROM users WHERE phone='%s'", phone)

// ✅ GOOD: Parameterized query
query := "SELECT * FROM users WHERE phone_number = $1"
row := db.QueryRow(query, phone)

// ❌ BAD: No input validation
const createAccount = (phone: string, password: string) => {
  // Direct use without validation
}

// ✅ GOOD: Input validation
const createAccount = (phone: string, password: string) => {
  if (!validatePhoneNumber(phone)) {
    throw new Error('Invalid phone number');
  }
  if (password.length < 8) {
    throw new Error('Password too short');
  }
}

Secrets Management

✅ Check:

• No hardcoded secrets in code
• Environment variables used for secrets
• .env files in .gitignore
• JWT secret minimum 32 characters
• Database credentials not in code
• API keys not committed to git
• Secrets rotated regularly (documented)

Example Issues:

// ❌ BAD: Hardcoded secret
jwtSecret := "my-secret-key"

// ✅ GOOD: Environment variable
jwtSecret := os.Getenv("JWT_SECRET")
if jwtSecret == "" {
  log.Fatal("JWT_SECRET not set")
}
if len(jwtSecret) < 32 {
  log.Fatal("JWT_SECRET must be at least 32 characters")
}

Cryptography

✅ Check:

• Using standard crypto libraries (no custom crypto)
• TLS/​HTTPS enforced in production
• Certificate validation enabled
• Secure random number generation
• No deprecated crypto algorithms
• Proper key derivation (PBKDF2, bcrypt, scrypt)

Example Issues:

// ❌ BAD: Weak random generation
const token = Math.random().toString(36);

// ✅ GOOD: Crypto-secure random
import { randomBytes } from 'crypto';
const token = randomBytes(32).toString('hex');

Data Protection

✅ Check:

• Sensitive data encrypted at rest
• Sensitive data encrypted in transit
• PII handling compliant (GDPR, CCPA)
• Data retention policies documented
• Secure deletion implemented
• Audit logs for sensitive operations
• Rate limiting on sensitive endpoints

Code Quality Audit

Error Handling

✅ Check:

• All errors properly handled
• No empty catch blocks
• Errors logged with context
• User-friendly error messages
• Error messages don't leak sensitive info
• Proper error propagation
• Graceful degradation

Example Issues:

// ❌ BAD: Ignored error
user, _ := getUserByPhone(phone)

// ✅ GOOD: Proper error handling
user, err := getUserByPhone(phone)
if err != nil {
  log.Printf("[ERROR] Failed to get user %s: %v", phone, err)
  return nil, fmt.Errorf("user lookup failed: %w", err)
}

// ❌ BAD: Generic error message
catch (error) {
  throw new Error('Something went wrong');
}

// ✅ GOOD: Specific, actionable error
catch (error) {
  if (error.code === 'ECONNREFUSED') {
    throw new Error('Backend server is not available. Please check your connection.');
  }
  log.error('API call failed:', error);
  throw error;
}

Code Organization

✅ Check:

• Single Responsibility Principle followed
• Functions/​methods under 50 lines
• Files under 500 lines
• Proper separation of concerns
• No God objects/​classes
• Consistent file structure
• Logical code grouping

Example Issues:

// ❌ BAD: One file doing everything (500+ lines)
class AuthService {
  login() { /​* 100 lines */ }
  register() { /​* 100 lines */ }
  sendOTP() { /​* 50 lines */ }
  verifyOTP() { /​* 50 lines */ }
  validatePhone() { /​* 30 lines */ }
  hashPassword() { /​* 20 lines */ }
  // ... many more methods
}

// ✅ GOOD: Separated concerns
class AuthService {
  constructor(
    private otpService: OTPService,
    private passwordService: PasswordService,
    private phoneValidator: PhoneValidator
  ) {}

  async login(phone: string, password: string) { /​* 20 lines */ }
  async register(phone: string, password: string) { /​* 25 lines */ }
}

Naming Conventions

✅ Check:

• Descriptive variable names
• Function names are verbs
• Class names are nouns
• Constants in UPPER_CASE
• Boolean variables prefixed (is, has, should)
• Consistent naming across platforms
• No abbreviations unless standard

Example Issues:

// ❌ BAD: Unclear naming
func p(u string, p string) error { }

// ✅ GOOD: Clear naming
func authenticateUser(phoneNumber string, password string) error { }

Documentation

✅ Check:

• All public functions documented
• Complex logic explained with comments
• API endpoints documented
• README up-to-date
• Inline comments for "why" not "what"
• Type definitions documented
• Examples provided

Example Issues:

// ❌ BAD: No documentation
function validateToken(token: string): boolean {
  // Complex validation logic
}

// ✅ GOOD: Documented
/​**
 * Validates a JWT token's signature and expiry.
 *
 * @param token - The JWT token string to validate
 * @returns true if token is valid and not expired, false otherwise
 * @throws Error if token format is invalid
 */
function validateToken(token: string): boolean {
  // Validation logic
}

Architecture Audit

Separation of Concerns

✅ Check:

• Business logic separated from UI
• Data layer separated from business logic
• API layer clearly defined
• No business logic in database
• No UI logic in services
• Clear module boundaries

Example Issues:

// ❌ BAD: UI component contains business logic
const LoginScreen = () => {
  const handleLogin = async () => {
    // Database query in UI component
    const user = await db.query('SELECT * FROM users WHERE phone = ?', phone);
    if (user && bcrypt.compareSync(password, user.password_hash)) {
      // JWT generation in UI
      const token = jwt.sign({ userId: user.id }, SECRET);
      // Success
    }
  };
};

// ✅ GOOD: Proper separation
const LoginScreen = () => {
  const authService = useAuthService();

  const handleLogin = async () => {
    const result = await authService.login(phone, password);
    if (result.success) {
      navigate('/​dashboard');
    }
  };
};

Dependency Management

✅ Check:

• No circular dependencies
• Dependencies clearly documented
• Minimal external dependencies
• All dependencies security-scanned
• Dependency versions pinned
• Unused dependencies removed
• Dependency injection used appropriately

Check for issues:

# Desktop (npm)
npm audit
npm outdated

# Backend (Go)
go mod verify
go list -m -u all

# iOS (CocoaPods)
pod outdated

# Android (Gradle)
./​gradlew dependencyUpdates

API Design

✅ Check:

• RESTful principles followed
• Consistent endpoint naming
• Proper HTTP methods used
• Appropriate status codes
• Versioned API endpoints (/​v1/)
• Consistent response format
• Error responses standardized

Example Issues:

❌ BAD: Inconsistent API design
POST /​login              → {user: {...}, token: "..."}
POST /​register           → {success: true, data: {...}}
GET  /​getUserProfile     → {profile: {...}}

✅ GOOD: Consistent API design
POST /​v1/​auth/​login      → {success: true, user: {...}, accessToken: "..."}
POST /​v1/​auth/​register   → {success: true, user: {...}, accessToken: "..."}
GET  /​v1/​user/​profile    → {success: true, profile: {...}}

Performance Audit

Database Queries

✅ Check:

• All foreign keys indexed
• Frequently queried columns indexed
• No N+1 query problems
• Queries use EXPLAIN ANALYZE
• Connection pooling configured
• Transaction boundaries appropriate
• Batch operations where possible

Example Issues:

-- ❌ BAD: Missing index
SELECT * FROM vpn_connections WHERE user_id = 123;
-- No index on user_id → Full table scan

-- ✅ GOOD: Indexed column
CREATE INDEX idx_vpn_connections_user_id ON vpn_connections(user_id);
SELECT * FROM vpn_connections WHERE user_id = 123;

// ❌ BAD: N+1 query problem
users := getUsers()
for _, user := range users {
  stats := getStatsForUser(user.ID) // Query per user!
}

// ✅ GOOD: Single query with JOIN
stats := getUsersWithStats() // One query with JOIN

Resource Management

✅ Check:

• Database connections closed
• File handles closed
• HTTP connections reused
• Memory leaks absent
• Goroutine/​async leaks absent
• Proper cleanup in finally/​defer
• Caching implemented appropriately

Example Issues:

// ❌ BAD: Resource leak
func getData() ([]byte, error) {
  resp, err := http.Get(url)
  if err != nil {
    return nil, err
  }
  return ioutil.ReadAll(resp.Body)
  // Body never closed!
}

// ✅ GOOD: Proper cleanup
func getData() ([]byte, error) {
  resp, err := http.Get(url)
  if err != nil {
    return nil, err
  }
  defer resp.Body.Close()
  return ioutil.ReadAll(resp.Body)
}

Algorithmic Efficiency

✅ Check:

• Time complexity reasonable
• Space complexity acceptable
• No unnecessary iterations
• Appropriate data structures used
• Search/​sort algorithms optimal
• Batch processing where possible

Example Issues:

// ❌ BAD: O(n²) when O(n) possible
const findDuplicates = (arr: string[]) => {
  const duplicates = [];
  for (let i = 0; i < arr.length; i++) {
    for (let j = i + 1; j < arr.length; j++) {
      if (arr[i] === arr[j]) duplicates.push(arr[i]);
    }
  }
  return duplicates;
};

// ✅ GOOD: O(n) with Set
const findDuplicates = (arr: string[]) => {
  const seen = new Set();
  const duplicates = new Set();
  for (const item of arr) {
    if (seen.has(item)) duplicates.add(item);
    seen.add(item);
  }
  return Array.from(duplicates);
};

Audit Report Template

# BarqNet Audit Report

**Date:** {Date}
**Auditor:** {Name/​Agent}
**Scope:** {What was audited}
**Codebase Version:** {Git commit/​tag}

---

## Executive Summary

**Overall Rating:** 🟢 Good | 🟡 Fair | 🔴 Poor

Brief summary of findings and overall assessment.

---

## Critical Issues 🔴

Issues that must be fixed immediately (security vulnerabilities, data loss risks).

### Issue 1: {Title}

**Severity:** Critical
**Location:** `file.ts:123`
**Category:** Security

**Description:**
Detailed description of the issue.

**Impact:**
What could happen if not fixed.

**Code:**
```typescript
// Current problematic code
const issue = currentCode();

Recommendation:

// Suggested fix
const fixed = betterCode();

Priority: Fix immediately before production deployment

---

High Priority Issues 🟡

Issues that should be addressed soon.

Issue 2: {Title}

...

---

Medium Priority Issues ⚠️

Issues that should be addressed but not blocking.

---

Low Priority Issues / Improvements 📝

Nice-to-have improvements.

---

Positive Findings ✅

Things done well that should be maintained.

• Good implementation of JWT token refresh
• Excellent error handling in auth service
• Strong password hashing (bcrypt cost 12)

---

Metrics

Files Audited: X Lines of Code: Y Issues Found: Z

By Severity:

• Critical: X
• High: Y
• Medium: Z
• Low: W

By Category:

• Security: X
• Performance: Y
• Code Quality: Z
• Architecture: W

---

Recommendations

Short-term (1-2 weeks)

1. Fix all critical issues
2. Address high-priority security items

Medium-term (1-2 months)

1. Refactor identified code smells
2. Improve test coverage

Long-term (3+ months)

1. Architecture improvements
2. Performance optimizations

---

Conclusion

Final assessment and next steps.

---

Next Audit: {Recommended date}

## Platform-Specific Audit Points

### Backend (Go)

✅ **Check:**
- [ ] Goroutine leaks (use `runtime.NumGoroutine()`)
- [ ] Race conditions (`go test -race`)
- [ ] Proper use of context.Context
- [ ] Error wrapping with `%w`
- [ ] defer used for cleanup
- [ ] No panics in production code (use errors)
- [ ] Structured logging

**Tools:**
```bash
# Race detection
go test -race ./​...

# Vet (static analysis)
go vet ./​...

# Lint
golangci-lint run

# Security scan
gosec ./​...

# Dependencies scan
go list -json -m all | nancy sleuth

Desktop (TypeScript/​Electron)

✅ Check:

• No eval() or Function()
• Context isolation enabled
• nodeIntegration disabled in renderer
• Proper IPC usage (contextBridge)
• No remote module usage
• Content Security Policy set
• TypeScript strict mode enabled

Tools:

# Lint
npm run lint

# Type check
tsc --noEmit

# Security audit
npm audit

# Bundle analyzer
npm run analyze

iOS (Swift)

✅ Check:

• No force unwrapping (!) except where safe
• Proper optional handling
• ARC memory management correct
• No retain cycles (weak/​unowned)
• Keychain usage for secrets
• Background fetch appropriate
• App Transport Security configured

Tools:

# Static analysis
xcodebuild analyze -scheme BarqNet

# Instruments (memory leaks)
instruments -t Leaks

# SwiftLint
swiftlint

Android (Kotlin)

✅ Check:

• Proper lifecycle handling
• No memory leaks (LeakCanary)
• Background services appropriate
• Proper permission requests
• ProGuard/​R8 rules correct
• SSL pinning implemented
• Encrypted storage for secrets

Tools:

# Lint
./​gradlew lint

# Security scan
./​gradlew dependencyCheckAnalyze

# Static analysis
./​gradlew detekt

# LeakCanary (runtime)
# Add to build.gradle dependencies

Common Vulnerability Patterns

CWE-89: SQL Injection

// ❌ Vulnerable
query := fmt.Sprintf("SELECT * FROM users WHERE id=%s", userInput)

// ✅ Fixed
query := "SELECT * FROM users WHERE id=$1"
db.Query(query, userInput)

CWE-79: Cross-Site Scripting (XSS)

// ❌ Vulnerable
element.innerHTML = userInput;

// ✅ Fixed
element.textContent = userInput;

CWE-798: Hard-coded Credentials

// ❌ Vulnerable
const jwtSecret = "hardcoded-secret-123"

// ✅ Fixed
jwtSecret := os.Getenv("JWT_SECRET")

CWE-327: Weak Cryptography

// ❌ Vulnerable
const hash = crypto.createHash('md5').update(password).digest('hex');

// ✅ Fixed
const hash = await bcrypt.hash(password, 12);

CWE-502: Deserialization of Untrusted Data

// ❌ Vulnerable
const data = JSON.parse(userInput);

// ✅ Fixed
const data = JSON.parse(userInput);
validateSchema(data); // Validate before use

Automated Audit Workflow

#!/​bin/​bash
# audit.sh - Run all audit tools

echo "🔍 Running BarqNet Audit..."

# Backend
echo "📦 Auditing Backend (Go)..."
cd /​Users/​hassanalsahli/​Desktop/​go-hello-main
go vet ./​...
golangci-lint run
gosec ./​...

# Desktop
echo "🖥️  Auditing Desktop (TypeScript)..."
cd /​Users/​hassanalsahli/​Desktop/​ChameleonVpn/​barqnet-desktop
npm audit
npm run lint
tsc --noEmit

# iOS
echo "📱 Auditing iOS (Swift)..."
cd /​Users/​hassanalsahli/​Desktop/​ChameleonVpn/​BarqNet
swiftlint

# Android
echo "🤖 Auditing Android (Kotlin)..."
cd /​Users/​hassanalsahli/​Desktop/​ChameleonVpn/​BarqNetApp
./​gradlew lint
./​gradlew detekt

echo "✅ Audit complete! Check reports in ./​audit-reports/"

When to Use This Skill

✅ Use this skill when:

• Reviewing code changes before merge
• Conducting security assessments
• Evaluating architecture decisions
• Checking code quality
• Pre-production audits
• Investigating bugs
• Performance troubleshooting
• Compliance verification

❌ Don't use this skill for:

• Writing new code (use platform-specific skills)
• Documentation (use barqnet-documentation)
• Testing (use barqnet-testing)
• Integration work (use barqnet-integration)

Success Criteria

An audit is complete when:

1. ✅ All critical security issues identified
2. ✅ Code quality issues documented
3. ✅ Performance bottlenecks found
4. ✅ Architecture concerns noted
5. ✅ Comprehensive report generated
6. ✅ Actionable recommendations provided
7. ✅ Priority levels assigned
8. ✅ Fix examples provided
9. ✅ Follow-up audit scheduled