# Security Scanning > Scan code for security vulnerabilities. Use after implementation changes. Use when this capability is needed. - Skill: `tomevault-io/security-scanning` (Agent Skill, multi-file: 2 files) - Install (CLI): `npx skillmds@latest add tomevault-io/security-scanning` - Raw SKILL.md: https://api.skillmd.com/api/skills/tomevault-io/security-scanning/raw - Safety review: pending - Works with: Claude Code, Claude.ai, OpenAI Codex - Category: Security - Author: tomevault-io (https://skillmd.com/u/tomevault-io) - Updated: 2026-09-17 - Page: https://skillmd.com/skills/tomevault-io/security-scanning --- # Security Scanning Verify security requirements are implemented and scan for common vulnerabilities. ## Scan Areas 1. **Controls**: Verify required controls are implemented 2. **OWASP Top 10**: Check for common vulnerabilities 3. **Secrets**: Ensure no hardcoded credentials 4. **Input/Output**: Validate proper sanitization ## Output Create `security-findings.md` using the template in `templates/security-findings.md`. ## Tips - Check against security-requirements.md - Look for injection vulnerabilities - Verify authentication/authorization checks - Ensure proper error handling (no info leakage) - Check for hardcoded secrets or sensitive data --- > Converted and distributed by [TomeVault](https://tomevault.io/claim/amattas) — claim your Tome and manage your conversions.