| name | security-audit |
| type | workflow |
| description | Comprehensive security auditing workflow covering web application testing, API security, penetration testing, vulnerability scanning, and security hardening. |
| context | fork |
| agent | security-engineer |
| when_to_use | When performing security audits, vulnerability scanning, penetration testing, or hardening web applications and APIs |
| allowed-tools | Read, Glob, Grep, Bash |
| argument-hint | [target: api|frontend|backend|infra|full] |
| user-invocable | true |
| effort | 5 |
Security Auditing Workflow
Systematic security review using static analysis tools available in the codebase.
Covers OWASP Top 10, secrets exposure, auth patterns, and dependency risk.
Phase 1: Reconnaissance — Map the Attack Surface
-
Identify entry points — list all routes/controllers:
grep -rn "app\.\(get\|post\|put\|delete\|patch\)\|@app\.route\|router\." src/ --include="*.{js,ts,py}" | head -60
-
Identify auth middleware — check which routes are protected:
grep -rn "auth\|middleware\|guard\|require_login\|jwt\|bearer" src/ -i --include="*.{js,ts,py}" | head -40
-
Map external dependencies — check package files for known-risky libs:
cat package.json 2>/dev/null || cat requirements.txt 2>/dev/null || cat go.mod 2>/dev/null
-
Note findings — list: total endpoints found, unprotected routes, third-party auth libs.
Phase 2: Secrets & Sensitive Data Exposure
-
Scan for hardcoded secrets:
grep -rn "password\s*=\s*['\"][^'\"]\|api_key\s*=\s*['\"][^'\"]\|secret\s*=\s*['\"][^'\"]" src/ -i | grep -v ".example" | head -30
-
Scan for tokens/keys in source:
grep -rEn "(sk-|AIza|AKIA|ghp_|xox[baprs]-)[A-Za-z0-9]+" src/ | head -20
-
Check .env files are gitignored:
cat .gitignore | grep -i "\.env" ; ls -la .env* 2>/dev/null
-
Check for secrets in logs:
