cso

Invoke the audit and choose a scope: full audit, infrastructure only, code only, supply chain, diff only, or a custom path. The audit runs phased checks across secrets, dependencies, CI/CD, OWASP Top 10, and STRIDE, then produces a prioritized findings report.

Daily mode uses an 8/10 confidence gate so only high-confidence, verified findings are reported with zero noise. Comprehensive mode lowers the gate to 2/10, reporting even speculative findings clearly labeled, suited for monthly deep scans.

Yes, the diff mode restricts the audit scope to files changed relative to the main branch using git diff. This is useful for reviewing pull requests without re-scanning the entire codebase.

Yes, a dedicated phase checks GitHub Actions for unpinned action references, pull_request_target injection risks, logged secrets, and excessive permissions. It also reviews Docker builds for secrets in layers and unpinned base images.

The audit maintains a hard exclusion list of 22 patterns that are categorically not vulnerabilities, such as dev-only console logging, test credentials, and placeholder values in example files. This prevents false positives from diluting real findings.

Reports are saved to a .superstack/security-reports/ directory named by project slug and date. A history file tracks finding counts over time, highlighting new, resolved, and persistent findings between audits.