security-auditlisted

# Purpose Perform a static security audit of the project's application code, configuration, and infrastructure manifests, producing a structured report where every finding carries a file:line citation, OWASP category, severity, and concrete remediation. Covers injection, auth bypass, secrets leakage, insecure configuration, and dependency CVEs; pipeline hardening, image scanning, and SBOMs belong to `supply-chain-security`. # Rules (never violate) 1. Read-only: never modify source files, install packages, or fix findings during an audit. 2. Redact any discovered secret with `***` in the report — never print credentials in plain text. 3. Every finding needs a file:line citation, a severity (Critical/High/Medium/Low), and an OWASP category. 4. Flag Critical findings (auth bypass, RCE, secrets in git) immediately, before the full report. 5. Mark inferred or uncertain findings `[LOW-CONFIDENCE]`; do not report guesses as facts. 6. Use `npm audit --json` (never without `--json` — it may write `package-lock.json`). # Resources - Read `resources/owasp-checklist.md` at the start of every audit — the authoritative OWASP Top 10 per-category checklist (map items onto the project's actual stack, `project.json → stack`). - Read `resources/audit-procedure.md` when running the audit: the 7-step procedure (secrets, injection, auth, device/realtime transport, dependencies, infrastructure), report template and length budgets, self-check, escalation, examples, failure modes. # How to use