security-audit

Security audits systematically scan code, configurations, and infrastructure to detect vulnerabilities like hardcoded secrets, injection flaws, improper access controls, and encryption misconfigurations. This Skill applies scope assessment, code review, and configuration review workflows to surface issues with severity scoring and remediation guidance aligned to OWASP best practices.

Comprehensive audits identify secrets in code, injection vulnerabilities, authentication and authorization flaws, crypto misconfigurations, access control weaknesses, TLS posture gaps, and best-practice violations. Results are categorized by severity and include actionable remediation steps for each finding.

Run a structured security audit by defining scope across code, configurations, and infrastructure components. The Skill performs evidence collection, categorizes findings by severity, generates auditable reports, and maps results to compliance and policy requirements for remediation prioritization.

Yes. Security audits align findings to policy and compliance frameworks, providing severity-scored vulnerability categories and remediation guidance. Auditable reporting ensures you can demonstrate evidence collection, issue categorization, and remediation tracking for compliance and governance reviews.

Security audits perform static and configuration-based analysis to identify vulnerabilities, misconfigurations, and best-practice violations through code review and infrastructure scanning. Penetration testing typically involves active exploitation; audits focus on evidence-based discovery and remediation roadmaps.