modernize-harden

To find security vulnerabilities in legacy code without modifying source, you can run a scanning workflow that audits the directory and generates a reviewable remediation patch. This approach ensures the original codebase remains untouched during hardening.

A legacy code hardening scan looks for injection flaws, authentication bypasses, data exposure, and insecure deserialization. It triages these security vulnerabilities to produce a targeted patch plan for critical issues.

Yes, you can use standard SAST tools like npm audit, pip-audit, and OWASP Dependency-Check for scanning legacy directories. The workflow relies on these tools alongside a security-auditor subagent to identify vulnerabilities.

You generate a reviewable patch for critical security issues by running an adversarial audit workflow on the old codebase. The process validates the patches and writes the security findings and remediation artifacts to an analysis directory for review.

The best way to present and verify security patches before applying them is to output artifacts to a designated analysis folder. This workflow validates the generated remediation patches against the legacy codebase to ensure safety before human review.