autoresearch:security

EXECUTE IMMEDIATELY.

Parse Arguments

Extract from $ARGUMENTS:

• Scope: or --scope — file globs to audit
• Focus: — specific area (auth, API, data handling, etc.)
• Depth: or --depth — quick (5 iterations), standard (15), deep (30+)
• Iterations: or --iterations — default 15. "unlimited" for unbounded.
• --diff — delta mode: only audit files changed since last audit
• --fix — after audit, auto-fix Critical/High findings (chains to fix)
• --fail-on <severity> — exit non-zero if findings at/above threshold (CI gate)
• --evals, --evals-interval N, --chain, --<subcommand>

Setup (if required context missing)

If Scope missing and no --diff:

1. Scan codebase for tech stack, frameworks, API routes
2. AskUserQuestion (single batch): Q1 (Scope): "What to audit?" — entire codebase, API + middleware, auth, external-facing Q2 (Depth): "How thorough?" — quick (5), standard (15), deep (30+), unlimited Q3 (Action): "What to do with findings?" — report only, report + auto-fix, report + CI gate If all provided → skip.

Setup Phase (once, before loop)

1. Reconnaissance — scan: package.json/requirements.txt (deps), .env.example (secrets), Dockerfile (infra), API route files (attack surface), auth/middleware (trust boundaries), DB schemas (data assets), CI/CD configs (supply chain)
2. Asset Identification — catalog data stores, auth systems, external services, user inputs
3. Trust Boundary Mapping — browser↔server, public↔authenticated, user↔admin, CI↔prod
4. STRIDE Threat Model — generate threats per category. Load references/security-checklist.md for checklist.
5. Attack Surface Map — entry points, data flows, abuse paths
6. Baseline — count known issues, initialize coverage tracking

Create output directory: autoresearch/security-{YYMMDD}-{HHMM}/ Write: overview.md, threat-model.md, attack-surface-map.md TSV header: # metric_direction: higher_is_better\niteration\ttimestamp\tfinding\tseverity\towasp\tstride\tevidence\tfile_line