speckit.security-audit

Auditing backend code for OWASP Top 10 vulnerabilities and CASL authorization gaps requires running a phased assessment that validates RBAC enforcement and file upload controls, ultimately producing an evidence-based report with file paths and a CASL coverage matrix.

A CASL coverage matrix in a backend security audit maps enforced permission policies against project scopes to validate RBAC enforcement, ensuring authorization rules align with LCBP3 security requirements and architectural decisions.

Validating ADR-016 security decisions during a code review involves cross-referencing architectural guidelines against the backend security posture, checking phase-by-phase compliance across authorization controls and file upload mechanisms.

Yes, the security audit covers file upload controls and RBAC enforcement by validating CASL permission policies across backend services, mapping them against project scopes to identify authorization gaps before production.

The best way to identify compliance issues in an LCBP3-DMS codebase is executing a full security audit that cross-references ADR-016 decisions and OWASP Top 10 risks, delivering an evidence-based report with actionable recommendations.