security-audit

Invoke the audit with a path or the full flag, such as zuvo:security-audit full, to scan the entire project. Use --quick for a fast pass covering secrets, auth coverage, and critical gates only, or --live-url to add runtime probing against a staging environment.

It checks injection, XSS, SSRF, broken authentication and authorization, multi-tenant isolation, hardcoded secrets, missing security headers, vulnerable dependencies, file upload and path traversal, business logic flaws, and infrastructure misconfigurations across Docker, CI/CD, Kubernetes, and Terraform.

Yes, it supports Next.js, NestJS, Express, FastAPI, Django, Flask, PHP/Yii2, Astro, Hono, and others. Stack detection runs in Phase 0 and loads framework-specific rules and tools such as taint tracing for Django and route mapping for Next.js.

No, live probing with --live-url is refused against production environments. It is allowed on localhost freely and on staging only after plan approval, and mutation requests like POST, PUT, or DELETE require explicit per-endpoint approval.

It applies a 3-tier confidence model that shows only HIGH-confidence findings in the main report, moves MEDIUM findings to a Needs Verification section, and excludes LOW-confidence noise entirely. This reduces false positives compared to raw grep or semgrep output.

Use security-audit for static code review, dependency scanning, and configuration hardening before releases. Use the pentest skill when you need active exploit verification, since security-audit observes and reports but does not execute exploit payloads.