security-scanlisted

# PMO Skill: Security Scan > **Purpose:** ตรวจ code ที่ Dev เขียน / Scaffold ที่ generate ด้วย security rules 53 ข้อ > ดึง concept จาก external execution-framework security scanning --- ## 1. When to Use - หลัง Dev report เสร็จ (ก่อนส่ง QA) - ก่อนรัน Deploy Checklist - เมื่อ PM/Dev ขอ "scan security" หรือ "ตรวจความปลอดภัย" - Auto-trigger จาก Quality Gate Post-Gate (ถ้า project มี Scaffold/) --- ## 2. Security Rules (53 Rules, 6 Categories) ### A: Secrets Detection (20 rules) — Critical/High - Stripe, AWS, GitHub, Slack, Google Cloud, Azure, Twilio, SendGrid, Mailgun tokens - RSA/EC/OpenSSH private keys, JWT tokens, npm tokens - MongoDB/SQL connection strings, Docker registry auth - .env files committed, hardcoded passwords, API keys in URLs, Firebase config ### B: Permissions (8 rules) — Critical/High - chmod 777, sudo in script, Docker root, wildcard CORS - Public S3/GCS buckets, disabled auth, weak CSP, missing RBAC ### C: Injection (11 rules) — Critical/High - SQL concat, command injection, XSS (innerHTML/dangerously), path traversal - SSRF, template injection (eval/Function), CRLF, LDAP, XXE, prototype pollution ### D: AI-Specific Security (8 rules) — Critical/High - Prompt injection, model extraction, PII in AI context - Unlimited token limits, unvalidated AI output, missing rate limit - Cross-tenant data leakage, unmasked AI provider keys ### E: Configuration (3 rules) — Critical/High - Debug mode in production, default credentials, missing HTTPS ### F: Depe