security-audit

Security Audit

Investigate the codebase for security vulnerabilities across OWASP Top 10 categories, secrets exposure, supply chain risks, and language-specific patterns. Produces a scored SECURITY_AUDIT.md with prioritized remediation actions.

Core principle: Investigate, do not just grep. Read surrounding code to determine if a match is a genuine vulnerability, a false positive, or already mitigated. Only flag findings with specific file:line evidence and confirmed risk.

Prerequisite check

git --version 2>/dev/null && git rev-parse --is-inside-work-tree 2>/dev/null

Check for available security tools (optional but enhance analysis):

command -v gitleaks 2>/dev/null && echo "gitleaks: available"
command -v semgrep 2>/dev/null && echo "semgrep: available"
command -v trivy 2>/dev/null && echo "trivy: available"
command -v govulncheck 2>/dev/null && echo "govulncheck: available"

Proceed without tools — manual investigation still works. Note which tools are missing in the report.

Step 1: Scope and context

Determine what to audit and understand the application:

1. Detect tech stack — scan for go.mod, package.json, pyproject.toml, Cargo.toml, *.csproj to identify languages
2. Identify security-sensitive areas — search for files related to authentication, authorization, database access, API endpoints, cryptography, file handling
3. Determine scope — full codebase audit, specific module, or recent changes only (based on user input)
4. Read project docs — CLAUDE.md, README.md, CONTEXT.md for architectural context and known boundaries

Step 2: Automated scanning

Run available security tools before manual investigation. Tool findings guide where to focus manual review.

# Secrets in current code and git history
gitleaks detect -v 2>&1

# Static analysis (language-aware rule sets)
semgrep --config=auto --severity=ERROR . 2>&1

# Dependency vulnerabilities
trivy fs --severity HIGH,CRITICAL . 2>&1
# or: govulncheck ./... / npm audit / pip-audit / cargo audit