# Security Audit

> Use before deploying to staging or production. Use when asked "security audit", "is this safe to deploy", "check security before deploy", "pre-deploy checklist", "audit the api security", "review security".

- Skill: `uner4s/security-audit` (Agent Skill, multi-file: 2 files)
- Install (CLI): `npx skillmds@latest add uner4s/security-audit`
- Raw SKILL.md: https://api.skillmd.com/api/skills/uner4s/security-audit/raw
- Safety review: pending
- Works with: Claude Code, Claude.ai, OpenAI Codex
- Category: DevOps & Infra
- Author: Uner4s (https://skillmd.com/u/uner4s)
- Updated: 2026-09-22
- Page: https://skillmd.com/skills/uner4s/security-audit

---


# Security Audit

**Rule:** A `✗ FAIL` is a blocker — do not deploy. A `⚠ WARN` is a conversation — review and decide.

## Steps

1. Run the automated audit:
   ```bash
   bash ~/.claude/skills/security-audit/scripts/audit.sh
   ```

2. Fix every `✗ FAIL` before continuing — no exceptions

3. Review each `⚠ WARN` manually — decide if acceptable for this specific deploy

4. Manual checklist (cannot be automated):
   - [ ] All public endpoints are intentional and documented
   - [ ] JWT secret is strong (32+ random chars, not a word or phrase)
   - [ ] CORS origins match actual frontend URLs for this environment
   - [ ] Rate limiting thresholds make sense for expected traffic volume
   - [ ] No sensitive data written to logs (passwords, full tokens, PII)

5. Re-run after fixing to confirm clean pass before deploying