Security Audit

Security Audit Skill

A structured security review workflow inspired by gstack's /cso role. Treat every audit as if you are the Chief Security Officer: adversarial, systematic, and unapologetic about raising issues.

This skill is distinct from the security-scan development skill — it covers full threat modeling, not just code-level checks.

When to Use

• Before launching a new product or significant feature
• After adding authentication, authorization, or data handling code
• When onboarding to a codebase with unknown security posture
• Periodic audits (monthly, per-sprint, before major releases)

Audit Framework

OWASP Top 10 Checklist

Copilot will systematically check each OWASP category:

> Perform an OWASP Top 10 audit on this codebase. For each category:
> 1. Check if the application is potentially vulnerable
> 2. Find specific code locations if vulnerable
> 3. Recommend a fix
> 4. Rate severity: Critical / High / Medium / Low

OWASP categories to cover:

• A01 Broken Access Control — authorization bypasses, privilege escalation
• A02 Cryptographic Failures — weak encryption, hardcoded secrets, cleartext data
• A03 Injection — SQL, NoSQL, OS command, LDAP injection
• A04 Insecure Design — threat modeling gaps, missing security controls
• A05 Security Misconfiguration — default credentials, verbose errors, open cloud storage
• A06 Vulnerable Components — outdated dependencies with known CVEs
• A07 Auth Failures — session management, credential stuffing, weak passwords
• A08 Software Integrity — unsigned updates, insecure CI/CD, deserialization
• A09 Logging Failures — missing security logs, log injection
• A10 SSRF — server-side request forgery, internal service exposure

STRIDE Threat Modeling

For each major component (API endpoint, service, data store):

> Apply STRIDE threat modeling to the [component]. For each threat type,
> describe the attack vector, assess likelihood (1-5), assess impact (1-5),
> and recommend a mitigation.

Secrets Scan

> Scan the codebase for hardcoded secrets, API keys, passwords, and tokens.
> Include config files, environment examples, and test fixtures.

Check these patterns:

• Hardcoded API keys, tokens, passwords
• .env.example files with real values
• Comments containing credentials
• Git history (check .git log for accidentally committed secrets)
• Infrastructure-as-code files (Terraform, CloudFormation)

Dependency Audit

> Audit our dependencies for known CVEs. Run npm audit / pip audit / 
> bundler-audit and summarize critical and high severity issues.

Auth & Session Review

> Review the authentication and session management implementation:
> - Token expiration and refresh logic
> - Password hashing (bcrypt/argon2, not MD5/SHA1)
> - Session fixation and hijacking prevention
> - OAuth/OIDC implementation correctness
> - MFA implementation

Full Audit Workflow

# 1. Get the lay of the land
> Map the attack surface: list all public API endpoints, auth endpoints,
> file upload handlers, and external service integrations.

# 2. OWASP sweep
> Perform an OWASP Top 10 audit. Start with A01-A03 (highest frequency).

# 3. Threat model critical paths
> Apply STRIDE to our authentication flow and payment processing.

# 4. Secrets scan
> Scan for hardcoded secrets and credentials.

# 5. Dependency check
npm audit --audit-level=high

# 6. Generate report
> Generate a security audit report with:
> - Executive summary (3 sentences)
> - Critical findings (must fix before launch)
> - High findings (fix within 2 weeks)
> - Medium/Low findings (backlog)
> - Recommended next steps

Output Format

Request a structured report:

> Format the audit findings as a Markdown table:
> | Finding | Category | Severity | Location | Recommended Fix |

Tips

• Be adversarial: Ask Copilot to think like an attacker, not a developer
• Audit the happy path last: Most vulnerabilities are in error handling and edge cases
• Check the infrastructure too: Security isn't just code — review CORS config, headers, TLS
• Rotate secrets after audits: If you found any, assume they're compromised
• Schedule regular audits: Security debt accumulates; quarterly > never

Skill Differentiation

Run security-scan every PR. Run security-audit every sprint or release. Run evaluate-repository once on unfamiliar codebases.

See Also

• security-scan — Quick code-level vulnerability scan (OWASP grep + STRIDE per feature)
• evaluate-repository — Full repo security scorecard
• pr-multi-perspective-review — Security Lens in PR reviews
• secret-detection — Dedicated secret and credential scanning