security-audit

name	security-audit
description	Run a comprehensive security audit against a codebase. Covers OWASP Top 10, secrets exposure, dependency vulnerabilities, misconfigurations, and insecure patterns. Language-agnostic.
license	MIT
allowed-tools	["Read","Glob","Grep","Bash","AskUserQuestion"]

Security Audit

When asked to run a security audit, follow this systematic process. Adapt checks to the languages and frameworks detected in the project.

Step 1: Reconnaissance

Identify the tech stack before diving in.

1. Check for package manifests to identify languages and frameworks:
   • package.json, yarn.lock (Node.js)
   • requirements.txt, Pipfile, pyproject.toml (Python)
   • go.mod (Go)
   • Cargo.toml (Rust)
   • Gemfile (Ruby)
   • pom.xml, build.gradle (Java/Kotlin)
   • *.csproj (C#/.NET)
   • composer.json (PHP)
2. Identify entry points: API routes, web handlers, CLI entry points
3. Map external integrations: databases, caches, message queues, third-party APIs
4. Check for deployment configs: Dockerfile, docker-compose, k8s manifests, terraform, CI/CD configs