security-audit

# Security Audit Scan, detect, and fix security issues in codebases and infrastructure. Covers dependency vulnerabilities, secret detection, OWASP top 10, SSL/TLS verification, file permissions, and secure coding patterns. ## When to Use - Scanning project dependencies for known vulnerabilities - Detecting hardcoded secrets, API keys, or credentials in source code - Reviewing code for OWASP top 10 vulnerabilities (injection, XSS, CSRF, etc.) - Verifying SSL/TLS configuration for endpoints - Auditing file and directory permissions - Checking authentication and authorization patterns - Preparing for a security review or compliance audit ## Dependency Vulnerability Scanning ### Node.js ```bash # Built-in npm audit npm audit npm audit --json | jq '.vulnerabilities | to_entries[] | {name: .key, severity: .value.severity, via: .value.via[0]}' # Fix automatically where possible npm audit fix # Show only high and critical npm audit --audit-level=high # Check a specific package npm audit --package-lock-only # Alternative: use npx to scan without installing npx audit-ci --high ``` ### Python ```bash # pip-audit (recommended) pip install pip-audit pip-audit pip-audit -r requirements.txt pip-audit --format=json # safety (alternative) pip install safety safety check safety check -r requirements.txt --json # Check a specific package pip-audit --requirement=- <<< "requests==2.25.0" ``` ### Go ```bash # Built-in vuln checker go install golang.org/x/vuln/cmd/govulncheck@latest...