What problem does it solve? It gives developers a structured, repeatable way to review a project for common security vulnerabilities before deployment, covering authentication, injection, XSS, CSRF, secrets management, API security, race conditions, and LLM prompt injection, while recording which checks the team has consciously decided to ignore. ## Core Features & Use Cases - Category-scoped audits: Run a full OWASP-based checklist or narrow it to a single area such as auth, injection, xss, csrf, secrets, api, infra, prompt-injection, or race-condition. - Automated audit script: A bundled bash script scans for hardcoded secrets, .env files tracked in git, missing .gitignore entries, npm vulnerabilities, console.log statements, and security TODO markers. - Ignored-items tracking: An ignore flow records accepted risks with reason, date, and author in a SECURITY.md artifact, and excluded items are shown separately in every audit report. - Use Case: Before deploying a NestJS API, run the full audit to catch missing rate limiting, exposed secrets, and injection-prone queries, then ignore the checks that do not apply to your architecture with documented reasons. ## Quick Start Ask the assistant to run a security audit of this project using the security checklist, optionally naming a category like auth or secrets.
