ck:security

To run a STRIDE and OWASP security audit, apply this Skill to your source directories, dependency manifests, and configuration files. It produces severity-ranked findings to help you identify and prioritize insecure patterns before release.

Yes, you can automatically fix security vulnerabilities using the iterative auto-fix workflow. It applies prioritized fixes and performs guarded regression checks to ensure the changes do not break existing functionality.

The best way to detect exposed secrets and dependency vulnerabilities is to run language-appropriate dependency scans and regex-based secret detection. This process catches exposed keys, tokens, and known CVEs across your codebase.

Yes, the security audit performs structured threat analysis using STRIDE mapping and OWASP Top 10 checks to specifically surface authentication, injection, and data leakage issues in your source code.

You should run a STRIDE security audit during pre-release reviews, after major feature changes, or for periodic security checks. This timing ensures you catch high-impact findings and configuration issues before they reach production.