security-audit

# Security Audit

Systematic security review for application code, dependencies, and configuration.

**This skill is NOT a replacement for professional penetration testing or security audits.** It identifies common vulnerabilities and provides remediation guidance within the scope of code review.

## Audit Process

```
┌─────────────────────────────────────────────────────────────┐
│                    SECURITY AUDIT                            │
├─────────────────────────────────────────────────────────────┤
│                                                             │
│  1. SCOPE           2. SCAN              3. ANALYZE         │
│  ┌─────────────┐   ┌─────────────┐      ┌─────────────┐    │
│  │ Define area │ → │ Run tools   │  →   │ Review      │    │
│  │ Set depth   │   │ Check deps  │      │ findings    │    │
│  │ Identify    │   │ Grep code   │      │ Classify    │    │
│  │ constraints │   │             │      │ severity    │    │
│  └─────────────┘   └─────────────┘      └─────────────┘    │
│                                                             │
│  4. REMEDIATE       5. DOCUMENT                             │
│  ┌─────────────┐   ┌─────────────┐                         │
│  │ Fix critical│ → │ Report      │                         │
│  │ Create      │   │ Create ohno │                         │
│  │ guidance    │   │ tasks       │                         │
│  └─────────────┘   └─────────────┘                         │
│                                                             │
└─────────────────────────────────────────────────────────────┘
```

## Audit Types

| Type | Focus | When to Use |
|------|-------|-------------|
| Code Review | OWASP Top 10, injection, auth | New features, PRs, suspicious code |
| Dependency | CVEs, outdated packages | Before deploy, periodic, CI/CD |
| Configuration | Secrets, permissions, hardening | Infrastructure changes, new envs |
| Architecture | Attack surface, data flow | Design phase, major refactors |
| A