security-audit

Automate a security audit for codebases by invoking the skill with a project path to scan for vulnerabilities in code and dependencies. It identifies risks like secrets exposure and input validation flaws, providing prioritized remediation recommendations for deployment readiness.

Yes, the security audit includes secrets exposure checks that detect hardcoded keys, tokens, or credentials in both source code and configuration files. This helps surface sensitive data leaks during PR reviews and pre-deployment checks.

Dependency vulnerability scanning supports multi-language ecosystems including Node.js, Python, and Go. It identifies known CVEs and outdated libraries across package managers like npm, pip, and cargo to mitigate dependency risks.

The best way to check compliance and hardening is using an automated security audit to evaluate authentication, transport security like HTTPS, and error handling against best practices. This surfaces compliance gaps and provides prioritized mitigation guidance.

Yes, you can use the security audit during PR reviews to identify code vulnerabilities, including input validation and authentication flaws. It evaluates code changes against best practices and provides prioritized remediation recommendations.