vc-security

To automate a STRIDE and OWASP security audit, this Skill resolves your code scope, runs structured threat-modeling checks, inventories vulnerabilities, and produces a severity-ranked findings report for pre-release checks.

The best way to detect secrets and vulnerable dependencies is running an automated security audit that performs dependency checks and secret detection, mapping results to actionable categories within a severity-ranked report.

Yes, you can automatically fix security vulnerabilities found during an audit using the optional auto-fix flow, which iteratively applies remediations to your code scope using the vc-autoresearch guard pattern.

You should run a STRIDE security audit during pre-release checks, after adding authentication or data-handling features, and during periodic security reviews to identify and categorize vulnerabilities before deployment.

No, the automated security audit requires no external dependencies. It independently resolves your code scope, executes STRIDE and OWASP checks, performs secret detection, and generates the severity-ranked findings report.