critical-interval-security-checker

# Critical Interval Security Checker Analyze code to identify security-critical time intervals and timing vulnerabilities that could compromise security. ## Workflow ### 1. Identify Security-Critical Operations Look for code that handles: - **Authentication**: Login, logout, token generation - **Session management**: Session creation, validation, expiration - **Password operations**: Reset tokens, change requests - **Rate limiting**: Login attempts, API calls, password resets - **Token operations**: JWT, OAuth tokens, API keys - **MFA**: OTP codes, push notifications, backup codes ### 2. Check for Common Vulnerabilities See [vulnerability_patterns.md](references/vulnerability_patterns.md) for detailed patterns. **Critical checks**: - Missing expiration validation - Excessive timeout values - No rate limiting on sensitive endpoints - Client-side only expiration checks - Race conditions in expiration logic - Hardcoded timeout values - Inconsistent timeout enforcement - Timezone handling issues - Timing attack vulnerabilities ### 3. Use Automated Checker Run the automated checker script: ```bash # Check single file python scripts/check_intervals.py path/to/file.py # Check entire directory python scripts/check_intervals.py src/ # Specify language python scripts/check_intervals.py src/ --language python ``` The script detects: - 🔴 **Critical**: JWT decode without verification, timing attacks - 🟠 **High**: Missing expiration checks, no rate limiting - 🟡 **Medium**: ...