security-audit

Security Audit

Overview

Find vulnerabilities before attackers do. Security is not a feature — it's a constraint that applies to everything.

Core principle: Assume every input is hostile. Assume every boundary will be tested.

The Iron Law

NO DEPLOY WITHOUT SECURITY REVIEW. NO USER INPUT WITHOUT VALIDATION.

When to Use

• "Is this secure?"
• Before any production deployment
• When handling user data, payments, or authentication
• When adding new endpoints or APIs
• During any codebase audit
• After dependency updates
• When implementing authentication/authorization

When NOT to Use

• Active security breach in progress (use incident-response to contain, then this skill)
• Purely visual/UI changes with no data flow (use frontend-audit)
• Performance investigation only (use performance-audit)

Anti-Shortcut Rules

YOU CANNOT:
- Say "auth is handled" without tracing EVERY endpoint — one unprotected endpoint = breach
- Say "input is validated" without testing malicious input — test with: ', ", <, >, --, NULL, ${}, {{}}
- Assume the framework handles security — frameworks have defaults, defaults get overridden
- Skip authorization checks because "authentication is in place" — auth ≠ authz
- Trust client-side validation alone — server-side validation is mandatory
- Say "we use HTTPS" without checking HSTS, certificate pinning, and redirect behavior
- Skip dependency security because "we use popular packages" — popularity ≠ security
- Mark a finding as "Low" because exploitation seems unlikely — severity = impact × exploitability

Common Rationalizations (Don't Accept These)

Rationalization	Reality
"We're behind a firewall"	Firewalls don't prevent insider threats or lateral movement
"Nobody would try that"	Automated scanners try everything. Constantly.
"The framework handles security"	Frameworks handle defaults. Your code handles everything else.
"It's an internal tool"	Internal tools get attacked through compromised accounts
"We'll add security later"	Security retrofit costs 10x more than building it in
"This endpoint isn't sensitive"	Every endpoint is an attack surface
"We obscure the URL"	Security through obscurity is not security
"Only admins use this"	Admin accounts get compromised too