What problem does it solve? Teams lack a consistent, evidence-backed way to assess an entire repository for security vulnerabilities, exposed secrets, correctness defects, resource leaks, dependency risk, and standards conformance without mutating source code. ## Core Features & Use Cases - Whole-Repository Audit: Scans the worktree, staged index, tracked reports, and reachable Git history with a pinned, checksum-verified Gitleaks scanner, plus language-specific analyzers for .NET, JavaScript, Python, Java, Go, and Rust. - Standards Conformance Matrix: Maps findings to versioned controls from Microsoft SDL, OWASP ASVS 5.0, NIST SSDF, CIS Controls v8.1, SLSA 1.2, and OpenSSF Scorecard, producing an assurance conclusion of conformant, conformant-with-exceptions, non-conformant, or insufficient-evidence. - Governed Artifact Chain: Emits schema-validated findings, review, and remediation-plan reports bound to one audit run ID and an immutable content-addressed evidence snapshot, stopping for approval before any remediation. - Use Case: Run a full audit of a GitHub-hosted C# service to detect hard-coded credentials in history, disposal and async misuse, vulnerable transitive packages, and missing branch protection, then receive a prioritized remediation plan. ## Quick Start Ask the agent to run /audit-code on this repository and produce the validated findings, review, and remediation plan reports.
