security-auditlisted

# Security Audit ## Purpose Comprehensive security audit covering dependency vulnerabilities, secrets in code/git history, and container image scanning. Produces a prioritized remediation report. **Input:** None (scans current project) **Output:** Severity-grouped vulnerability report with remediation steps ## When to Use - Before a release - After adding new dependencies - Periodic security review ## Steps ### Step 1 — Dependency vulnerabilities Auto-detect: `bun.lockb` → `bun audit` | `package-lock.json` → `npm audit --json` | `yarn.lock` → `yarn audit` Group by severity: **critical → high → moderate → low** ### Step 2 — Outdated packages Run `bun outdated` or `npm outdated`. Flag packages more than 2 major versions behind. ### Step 3 — Secrets scan - Check git history for `.env`, `.key`, `.pem` files - Grep source for hardcoded passwords/API keys/secrets (excluding node_modules) ### Step 4 — Docker image scan If Dockerfile present and Docker available: `docker scout cves` ### Report - Total by severity - Top 3 critical/high with CVE - Recommended immediate actions - Packages safe to ignore (dev-only, not reachable in prod) ## Rules - Distinguish prod vs dev-only vulnerabilities - Never suggest `npm audit fix --force` without explaining what it changes