security-auditlisted

# Security Audit Skill Execute a comprehensive, end-to-end security audit on the current codebase. Inspect source code, configurations, dependencies, and environment files to identify and remediate security vulnerabilities across 19 critical checkpoints. --- ## 🎯 Scope & Objectives When invoked (`/security-audit` or when asked to perform a security check), analyze the repository against the following 6 domain modules: ### Module 1: Dependencies & Package Health 1. **Remove Unused Packages:** Identify unused npm, pip, go, or cargo dependencies and propose removal. 2. **Update Dependencies:** Scan for out-of-date or vulnerable package versions (`npm audit`, `pip-audit`, `cargo audit`, or equivalent). ### Module 2: Secrets & Environment Management 3. **Check Git for Secrets:** Scan commit history and stage area for hardcoded keys, JWT secrets, passwords, or tokens using tools like `trufflehog` or regex pattern matching. 4. **Hide API Keys:** Verify that external API keys are excluded from source control and loaded strictly via environment variables. 5. **Check Environment Variables:** Audit `.env.example` templates to ensure sensitive defaults are not checked into Git, and verify proper runtime validation of required `.env` keys. 6. **Check Exposed Files:** Ensure sensitive files (`.env`, `.pem`, `.key`, `id_rsa`, `.DS_Store`, database dumps, build artifacts) are properly listed in `.gitignore`. ### Module 3: Authentication & Access Control 7. **Proper Authentication:**