Ralph Security — 100 Iterations (~30-60 min)
Comprehensive security audit with balanced depth and duration.
References
- Severity definitions and triage guidance
Instructions
Execution Engine
YOU MUST follow this loop for EVERY iteration:
- STATE: Read current iteration (start: 1)
- PHASE: Determine phase from iteration number
- ACTION: Perform ONE check from current phase
- VERIFY: Before reporting FAIL — read actual code, check if a library handles it (jose, bcrypt, passport, Auth0, etc.), check DB constraints, check environment gating. If inconclusive:
NEEDS_REVIEW, not FAIL.
- REPORT: Output iteration result
- SAVE: Every 10 iterations, update
.ralph-report.md
- INCREMENT: iteration = iteration + 1
- CONTINUE: IF iteration <= 100 GOTO Step 1
- FINAL: Generate comprehensive report
Critical rules:
- ONE check per iteration — deep, not wide
- ALWAYS show
[SEC-X/100]
- NEVER skip iterations
- CRITICAL findings: flag for immediate attention
Per-Iteration Output
══════════════════════════════════════════════════════════
[SEC-{N}/100] Phase {P}: {phase_name}
Check: {specific_check}
══════════════════════════════════════════════════════════
Target: {file/endpoint/system}
Result: {PASS|FAIL|WARN|N/A}
Confidence: {VERIFIED|LIKELY|PATTERN_MATCH|NEEDS_REVIEW}
Severity: {CRITICAL|HIGH|MEDIUM|LOW|INFO}
Finding: {description}
Fix: {recommendation or "N/A"}
──────────────────────────────────────────────────────────
Progress: [██████████░░░░░░░░░░] {N}%
──────────────────────────────────────────────────────────
Persona
Senior security engineer. Evidence-based mindset, defense in depth, fail secure, least privilege.
Phase Structure (100 Iterations)
| Phase |
Iterations |
Focus Area |
| 1 |
1-15 |
Reconnaissance & Sync |
| 2 |
16-45 |
OWASP Top 10 Analysis |
| 3 |
46-65 |
Authentication & Secrets |
| 4 |
66-85 |
Infrastructure Security |
| 5 |
86-100 |
Code Quality & Report |
Phase 1: Reconnaissance (1-15)
| Iter |
Check |
| 1 |
Auto-detect stack and infra |
| 2 |
Git sync: local vs remote |
| 3 |
Uncommitted sensitive files |
| 4 |
.env in .gitignore |
| 5 |
Public endpoints enumeration |
| 6 |
Authentication requirements mapping |
| 7 |
Rate limiting coverage |
| 8 |
Exposed ports (host/container) |
| 9 |
Hidden services discovery |
| 10 |
Cron jobs and scheduled tasks |
| 11 |
Environment variable audit |
| 12 |
Docker environment check |
| 13 |
Documentation vs reality |
| 14 |
Attack surface score |
| 15 |
Phase 1 summary |
Phase 2: OWASP Top 10 (16-45)
| Iter |
OWASP |
Check |
| 16-18 |
A01 |
Broken Access Control (IDOR, CORS, path traversal) |
| 19-21 |
A02 |
Cryptographic Failures (weak algos, key mgmt, TLS) |
| 22-27 |
A03 |
Injection (SQL, Command, XSS, Template, Log) |
| 28-30 |
A04 |
Insecure Design (missing controls, business logic) |
| 31-33 |
A05 |
Security Misconfiguration (debug, errors, headers) |
| 34-36 |
A06 |
Vulnerable Components (dependency audit) |
| 37-39 |
A07 |
Auth Failures (credential stuffing, session mgmt) |
| 40-42 |
A08 |
Integrity Failures (deserialization, CI/CD) |
| 43-44 |
A09 |
Logging Failures (coverage, security) |
| 45 |
A10 |
SSRF (URL validation, metadata protection) |
Phase 3: Authentication & Secrets (46-65)
Pre-check: Determine if codebase uses well-known libraries vs custom implementations. Library-handled crypto is generally safe — focus on USAGE errors.
| Iter |
Check |
| 46-50 |
Secret detection (API keys, passwords, tokens) |
| 51-55 |
JWT security (algorithm, claims, storage, revocation) |
| 56-58 |
OAuth 2.0 (PKCE, redirect URI, state) |
| 59-62 |
Admin authentication (brute force, timing, lockout) |
| 63-65 |
Rate limiting analysis (coverage, bypass) |
Phase 4: Infrastructure (66-85)
| Iter |
Check |
| 66-70 |
Container security (non-root, readonly, limits) |
| 71-75 |
Network security (ports, firewall, isolation) |
| 76-78 |
TLS/SSL (cert validity, ciphers, HSTS) |
| 79-81 |
SSH security (key auth, config hardening) |
| 82-85 |
Database security (SSL, permissions, access) |
Phase 5: Code Quality & Report (86-100)
Pre-check: Check database constraints before flagging race conditions.
| Iter |
Check |
| 86-88 |
Race conditions (TOCTOU, concurrent access) |
| 89-91 |
Business logic flaws (workflow, rate limit bypass) |
| 92-94 |
Error handling (safe messages, fail-safe) |
| 95-97 |
Resource management (connections, memory) |
| 98 |
Critical findings review |
| 99 |
Security scorecard generation |
| 100 |
Final report generation |
Auto-Detect (Iteration 1)
git rev-parse --show-toplevel, git remote -v- Stack:
package.json, pyproject.toml, requirements.txt, go.mod
- Infra:
Dockerfile, docker-compose.yml, k8s manifests
- CI/CD:
.github/workflows, .gitlab-ci.yml
- Skip non-applicable checks, mark N/A
Report File
On start: rename existing .ralph-report.md to .ralph-report-{YYYY-MM-DD-HHmm}.md. Auto-save every 10 iterations.
Parameters
| Param |
Default |
Options |
--iterations |
100 |
1-200 |
--focus |
all |
recon, owasp, secrets, auth, infra, code, all |
--phase |
all |
1-5 |
--resume |
— |
Continue from checkpoint |
Context Limit Protocol
If approaching context limit: checkpoint to report file, output resume command, wait for new session.
When to Use
- Weekly security check
- New project onboarding
- Before major release
- Standard security audit
Converted and distributed by TomeVault — claim your Tome and manage your conversions.
1---2name: ralph-security3description: Comprehensive security audit with 100 iterations (~30-60 min). Use when user says 'security audit', 'ralph security', 'weekly security check', 'audit this project', 'new project security review', or 'check for vulnerabilities'. Covers OWASP Top 10, auth, secrets, infrastructure, and code quality. Use when this capability is needed.4---56# Ralph Security — 100 Iterations (~30-60 min)78Comprehensive security audit with balanced depth and duration.910## References1112- [Severity definitions and triage guidance](references/severity-guide.md)1314## Instructions1516### Execution Engine1718YOU MUST follow this loop for EVERY iteration:19201. **STATE**: Read current iteration (start: 1)212. **PHASE**: Determine phase from iteration number223. **ACTION**: Perform ONE check from current phase234. **VERIFY**: Before reporting FAIL — read actual code, check if a library handles it (jose, bcrypt, passport, Auth0, etc.), check DB constraints, check environment gating. If inconclusive: `NEEDS_REVIEW`, not `FAIL`.245. **REPORT**: Output iteration result256. **SAVE**: Every 10 iterations, update `.ralph-report.md`267. **INCREMENT**: iteration = iteration + 1278. **CONTINUE**: IF iteration <= 100 GOTO Step 1289. **FINAL**: Generate comprehensive report2930**Critical rules:**31- ONE check per iteration — deep, not wide32- ALWAYS show `[SEC-X/100]`33- NEVER skip iterations34- CRITICAL findings: flag for immediate attention3536### Per-Iteration Output3738```39══════════════════════════════════════════════════════════40[SEC-{N}/100] Phase {P}: {phase_name}41Check: {specific_check}42══════════════════════════════════════════════════════════43Target: {file/endpoint/system}44Result: {PASS|FAIL|WARN|N/A}45Confidence: {VERIFIED|LIKELY|PATTERN_MATCH|NEEDS_REVIEW}46Severity: {CRITICAL|HIGH|MEDIUM|LOW|INFO}47Finding: {description}48Fix: {recommendation or "N/A"}49──────────────────────────────────────────────────────────50Progress: [██████████░░░░░░░░░░] {N}%51──────────────────────────────────────────────────────────52```5354### Persona5556Senior security engineer. Evidence-based mindset, defense in depth, fail secure, least privilege.5758### Phase Structure (100 Iterations)5960| Phase | Iterations | Focus Area |61|-------|------------|------------|62| 1 | 1-15 | Reconnaissance & Sync |63| 2 | 16-45 | OWASP Top 10 Analysis |64| 3 | 46-65 | Authentication & Secrets |65| 4 | 66-85 | Infrastructure Security |66| 5 | 86-100 | Code Quality & Report |6768### Phase 1: Reconnaissance (1-15)6970| Iter | Check |71|------|-------|72| 1 | Auto-detect stack and infra |73| 2 | Git sync: local vs remote |74| 3 | Uncommitted sensitive files |75| 4 | .env in .gitignore |76| 5 | Public endpoints enumeration |77| 6 | Authentication requirements mapping |78| 7 | Rate limiting coverage |79| 8 | Exposed ports (host/container) |80| 9 | Hidden services discovery |81| 10 | Cron jobs and scheduled tasks |82| 11 | Environment variable audit |83| 12 | Docker environment check |84| 13 | Documentation vs reality |85| 14 | Attack surface score |86| 15 | Phase 1 summary |8788### Phase 2: OWASP Top 10 (16-45)8990| Iter | OWASP | Check |91|------|-------|-------|92| 16-18 | A01 | Broken Access Control (IDOR, CORS, path traversal) |93| 19-21 | A02 | Cryptographic Failures (weak algos, key mgmt, TLS) |94| 22-27 | A03 | Injection (SQL, Command, XSS, Template, Log) |95| 28-30 | A04 | Insecure Design (missing controls, business logic) |96| 31-33 | A05 | Security Misconfiguration (debug, errors, headers) |97| 34-36 | A06 | Vulnerable Components (dependency audit) |98| 37-39 | A07 | Auth Failures (credential stuffing, session mgmt) |99| 40-42 | A08 | Integrity Failures (deserialization, CI/CD) |100| 43-44 | A09 | Logging Failures (coverage, security) |101| 45 | A10 | SSRF (URL validation, metadata protection) |102103### Phase 3: Authentication & Secrets (46-65)104105**Pre-check:** Determine if codebase uses well-known libraries vs custom implementations. Library-handled crypto is generally safe — focus on USAGE errors.106107| Iter | Check |108|------|-------|109| 46-50 | Secret detection (API keys, passwords, tokens) |110| 51-55 | JWT security (algorithm, claims, storage, revocation) |111| 56-58 | OAuth 2.0 (PKCE, redirect URI, state) |112| 59-62 | Admin authentication (brute force, timing, lockout) |113| 63-65 | Rate limiting analysis (coverage, bypass) |114115### Phase 4: Infrastructure (66-85)116117| Iter | Check |118|------|-------|119| 66-70 | Container security (non-root, readonly, limits) |120| 71-75 | Network security (ports, firewall, isolation) |121| 76-78 | TLS/SSL (cert validity, ciphers, HSTS) |122| 79-81 | SSH security (key auth, config hardening) |123| 82-85 | Database security (SSL, permissions, access) |124125### Phase 5: Code Quality & Report (86-100)126127**Pre-check:** Check database constraints before flagging race conditions.128129| Iter | Check |130|------|-------|131| 86-88 | Race conditions (TOCTOU, concurrent access) |132| 89-91 | Business logic flaws (workflow, rate limit bypass) |133| 92-94 | Error handling (safe messages, fail-safe) |134| 95-97 | Resource management (connections, memory) |135| 98 | Critical findings review |136| 99 | Security scorecard generation |137| 100 | Final report generation |138139### Auto-Detect (Iteration 1)1401411. `git rev-parse --show-toplevel`, `git remote -v`1422. Stack: `package.json`, `pyproject.toml`, `requirements.txt`, `go.mod`1433. Infra: `Dockerfile`, `docker-compose.yml`, k8s manifests1444. CI/CD: `.github/workflows`, `.gitlab-ci.yml`1455. Skip non-applicable checks, mark N/A146147### Report File148149On start: rename existing `.ralph-report.md` to `.ralph-report-{YYYY-MM-DD-HHmm}.md`. Auto-save every 10 iterations.150151### Parameters152153| Param | Default | Options |154|-------|---------|---------|155| `--iterations` | 100 | 1-200 |156| `--focus` | all | recon, owasp, secrets, auth, infra, code, all |157| `--phase` | all | 1-5 |158| `--resume` | — | Continue from checkpoint |159160### Context Limit Protocol161162If approaching context limit: checkpoint to report file, output resume command, wait for new session.163164### When to Use165166- Weekly security check167- New project onboarding168- Before major release169- Standard security audit170171---172> Converted and distributed by [TomeVault](https://tomevault.io/claim/dorukardahan) — claim your Tome and manage your conversions.173<!-- tomevault:4.0:skill_md:2026-04-15 -->
tomevault-io