# LockNKey Security Plugin

## Overview
The **lockkey-security** plugin provides comprehensive security analysis and vulnerability assessment capabilities for the LockNKey password manager project. It specializes in identifying security issues specific to password managers, quantum cryptography implementations, and general application security best practices.

## Features

### Security Analysis Capabilities
- **OWASP Top 10 Vulnerability Assessment**: Systematic analysis of common web application vulnerabilities
- **Post-Quantum Cryptography Review**: Specialized review of CRYSTALS-Kyber, CRYSTALS-Dilithium, and SPHINCS+ implementations
- **Zero-Knowledge Architecture Validation**: Ensures client-side encryption and server-side security
- **Password Manager Security**: Specialized checks for vault encryption, auto-fill security, and secure sharing
- **Dependency Vulnerability Scanning**: Identifies outdated packages and known CVEs
- **Authentication & Authorization Review**: Validates access control mechanisms and session management
- **Secure Code Review**: Identifies injection vulnerabilities, input validation issues, and insecure patterns

### Security Engineer Agent
The plugin includes a **security-engineer** agent powered by Claude Haiku for fast security analysis:

**Specializations**:
- Vulnerability identification and classification
- Cryptographic implementation review
- Secure SDLC best practices
- Compliance validation (OWASP, NIST, password manager standards)
- Security testing strategy development
- Threat modeling and risk assessment

**Analysis Output**:
- Severity-based categorization (Critical, High, Medium, Low, Informational)
- Specific file locations and line numbers
- Impact assessment and CVSS scoring
- Remediation recommendations with code examples
- Security standard references (CWE, CVE, OWASP)

## Installation

1. **Ensure marketplace is enabled** in your Claude Code configuration
2. **Plugin location**: `/claude-marketplace/lockkey-security/`
3. **Activate plugin**: Use Claude Code marketplace interface to install the lockkey-security plugin

## Usage

### Invoking the Security Engineer Agent

```
@security-engineer Please review the authentication implementation in the vault service
```

```
@security-engineer Analyze the quantum encryption service for side-channel attack vulnerabilities
```

```
@security-engineer Perform a comprehensive security audit of the browser extension
```

### Common Security Analysis Tasks

**1. Code Review for New Pull Requests**
```
@security-engineer Review PR #123 for security vulnerabilities before merging
```

**2. Dependency Vulnerability Check**
```
@security-engineer Scan all dependencies for known security vulnerabilities
```

**3. Cryptographic Implementation Review**
```
@security-engineer Validate the CRYSTALS-Kyber implementation follows NIST standards
```

**4. Input Validation Analysis**
```
@security-engineer Check all API endpoints for injection vulnerabilities
```

**5. Authentication Security Assessment**
```
@security-engineer Review the Supabase Auth integration for security issues
```

## MCP Server Configuration

The plugin uses the following MCP servers:

### GitHub MCP
- **Purpose**: Code analysis, issue creation, pull request security reviews
- **Tools Available**:
  - `search_code`: Find security patterns across codebase
  - `search_issues`: Track security-related issues
  - `create_issue`: Document security findings
  - `get_file_contents`: Read files for security analysis
  - `list_pull_requests`: Review PRs for security
  - `pull_request_read`: Detailed PR security analysis

### Pieces MCP
- **Purpose**: Context retrieval for historical security decisions
- **Tools Available**:
  - `ask_pieces_ltm`: Query past security findings and decisions

## Security Checklist

The security-engineer agent systematically evaluates:

### Application Security
- [ ] OWASP Top 10 vulnerabilities
- [ ] Input validation and sanitization
- [ ] Authentication and authorization
- [ ] Session management
- [ ] Secure communication (TLS/SSL)
- [ ] Error handling and logging
- [ ] Security headers (CSP, HSTS, etc.)

### Cryptographic Security
- [ ] Post-quantum algorithm implementation
- [ ] Hybrid encryption schemes
- [ ] Key derivation and storage
- [ ] Master password security
- [ ] Side-channel attack resistance
- [ ] Crypto-agility mechanisms

### Password Manager Specific
- [ ] Zero-knowledge architecture
- [ ] Vault encryption security
- [ ] Auto-fill security and phishing protection
- [ ] Browser extension security
- [ ] Secure sharing and collaboration
- [ ] Import/export security
- [ ] Backup and recovery mechanisms

### Infrastructure Security
- [ ] Dependency vulnerabilities
- [ ] API security and rate limiting
- [ ] Database security
- [ ] Redis key storage security
- [ ] Container security (Docker)
- [ ] CI/CD security

## Integration with Development Workflow

### Pre-Commit Security Review
Invoke the security-engineer before committing sensitive code:
```
@security-engineer Review my changes for security issues before commit
```

### Pull Request Security Gate
Add security review as part of PR process:
```
@security-engineer Perform security analysis for PR before approval
```

### Regular Security Audits
Schedule periodic comprehensive security assessments:
```
@security-engineer Conduct full security audit of the quantum encryption service
```

### Incident Response
Quickly analyze reported security issues:
```
@security-engineer Investigate potential SQL injection in vault service API
```

## Output Format

Security findings are organized by severity:

**Critical**: Immediate action required
- Exploitable vulnerabilities
- Data exposure risks
- Authentication bypass

**High**: Urgent attention needed
- Significant security weaknesses
- Potential data breaches
- Privilege escalation risks

**Medium**: Timely remediation recommended
- Moderate security concerns
- Defense-in-depth gaps
- Configuration issues

**Low**: Improvement opportunities
- Minor security issues
- Best practice violations
- Hardening recommendations

**Informational**: Security awareness
- Documentation improvements
- Security education
- Proactive hardening

## Best Practices

1. **Regular Security Reviews**: Invoke security analysis for all new features
2. **Dependency Updates**: Scan dependencies weekly for vulnerabilities
3. **Cryptographic Validation**: Review all quantum crypto implementations
4. **Zero-Knowledge Verification**: Ensure no plaintext password exposure
5. **Browser Extension Security**: Regular CSP and isolation reviews
6. **Security Testing**: Integrate security unit tests in TDD workflow

## Future Enhancements

Planned additions to the security plugin:
- Integration with dedicated security MCP servers (OWASP ZAP, Semgrep)
- Automated SAST/DAST tool integration
- Security metrics dashboard
- Compliance report generation (SOC2, HIPAA, GDPR)
- Security training recommendations
- Threat modeling automation

## Support

For security concerns or plugin issues:
- File security issues with severity labels in GitHub
- Use `@security-engineer` for immediate security analysis
- Consult project CLAUDE.md for security development workflow

## Version History

**v1.0.0** (2025-10-16)
- Initial release
- Security engineer agent with Haiku model
- OWASP Top 10 analysis
- Post-quantum cryptography review
- Password manager security checks
- GitHub MCP integration for code analysis
