aif-security-checklist

Run a security audit by executing the audit script to scan code, configurations, and deployments for vulnerabilities. The script checks authentication, injection, XSS, CSRF, secrets management, and infrastructure, generating a SECURITY.md artifact documenting your project's security posture.

An OWASP-aligned code review includes automated checks for secrets exposure, environment tracking, dependency hygiene, production logging, authentication, injection, XSS, CSRF, and data handling. These checks enforce standard security controls across your code, configurations, and deployments.

Yes, you can customize the security checklist using project-specific overrides via skill-context rules. The configurable baseline reads ignore rules and security posture from the resolved artifact path, enabling conflict resolution between general and project-specific instructions for your repository.

Yes, the DevSecOps security audit operates without external dependencies. It relies on the SKILL.md frontmatter to define scope, allowed-tools, and defaults, utilizing internal scripts and references to evaluate your repository and generate the SECURITY.md artifact.

The best way to verify secrets management and infrastructure security is applying a structured audit checklist during pre-deployment reviews and architecture assessments. This enforces checks for secrets exposure, environment tracking, and standard controls, producing a repeatable SECURITY.md artifact.

You need a structured security checklist during pre-deployment reviews, code reviews, and architecture assessments. It provides a repeatable baseline to verify security controls across authentication, injection, XSS, CSRF, secrets management, and infrastructure, aligned with OWASP Top 10 best practices.