code-security-audit

Code Security Audit Capabilities

OWASP 4-source integrated code security audit system for universal codebase analysis.

Knowledge Sources

• OWASP ASVS 5.0.0: 345 verification requirements across 17 security domains (L1/L2/L3)
• OWASP API Security Top 10 2023: 10 API-specific risk categories with code-level indicators
• OWASP CheatSheet Series: 109 practical secure coding cheat sheets for remediation guidance
• OWASP WSTG (Web Security Testing Guide): 12 testing categories with 120+ test scenarios

Source Roles

Source	Role	Usage
ASVS 5.0.0	Verification requirements baseline	Defines what to check — structured requirements per domain
API Security Top 10 2023	Risk taxonomy	Defines what to look for — API-specific threat patterns
CheatSheet Series	Implementation guidance	Defines how to fix — secure coding patterns and practices
WSTG	Test methodology	Defines how to verify — concrete test scenarios per vulnerability

Domains

• Input Handling (V1, V2, V5): Encoding, sanitization, injection prevention, validation, file handling
• Authentication & Session (V6, V7, V9, V10): Auth mechanisms, session management, token handling, OAuth/OIDC
• Authorization (V8): Object-level, function-level, property-level access control
• Cryptography (V11, V12): Storage encryption, key management, TLS configuration
• API Security (V4, V17): REST/GraphQL/WebSocket/WebRTC security, rate limiting, resource consumption
• Data Protection (V14): Sensitive data exposure, privacy controls, client-side data
• Configuration (V13, V16): Security headers, CORS, error handling, logging, deployment hardening
• Secure Coding (V3, V15): Web frontend security, architecture patterns, defensive coding, concurrency safety

Input Contract

Field	Required	Description
Codebase path	Yes	The current workspace or repository the agent is operating in. Defaults to the active codebase; users may narrow scope to specific directories or files (e.g., src/auth/, api/controllers/)
Audit level	No	ASVS verification level (default: L2). See level definitions below
Focus areas	No	Security domains to prioritize. See focus area catalog below
Tech context	No	Language, framework, or architecture notes for targeted analysis

Audit Levels (OWASP ASVS 5.0.0)

Level	Target Application	Requirements	Description
L1	All applications	~86	Essential baseline — covers critical vulnerabilities that are typically exploitable and must be addressed in every application (e.g., SQL injection, OS command injection, basic auth checks)
L2	Applications handling sensitive data (PII, financial, health)	~230	Standard security — includes L1 plus defense-in-depth controls such as SSRF protection, template injection prevention, secure session management, and proper cryptographic usage
L3	Mission-critical systems (banking, healthcare, military, infrastructure)	~345	Comprehensive defense — includes L1+L2 plus advanced controls such as formula injection prevention, full input canonicalization, and exhaustive cryptographic verification

Focus Area Catalog

Focus Area	Domains	Example Checks
authentication	V6, V7, V9, V10	Password storage, MFA, OAuth/OIDC flow, credential rotation
authorization	V8	Object-level (BOLA), function-level, property-level access control
injection	V1, V2	SQLi, XSS, command injection, LDAP/XPath injection, template injection, XXE
cryptography	V11, V12	Weak algorithms, key management, TLS configuration, secret storage
api-security	V4, V17	Rate limiting, resource consumption, REST/GraphQL/WebSocket security
session	V7, V9, V10	Token handling, session fixation, cookie attributes, JWT validation, CSRF
file-handling	V5	Path traversal, unrestricted upload, file type validation, storage security
data-protection	V14	Sensitive data exposure, privacy controls, client-side data leakage
configuration	V13, V16	Security headers, CORS, error handling, logging, deployment hardening
secure-coding	V3, V15	Frontend security, concurrency safety, architecture patterns, defensive coding

Preconditions

• Codebase is accessible and readable
• Agent has file search and read capabilities
• If codebase structure cannot be determined, the agent reports limitations in the audit output

Core Capabilities

• Codebase Reconnaissance: Identifies technology stack, frameworks, entry points, and security-relevant file areas
• Domain-Scoped Analysis: Systematically audits code across all 8 security domains
• ASVS Requirement Verification: Checks code against applicable ASVS 5.0.0 requirements at the specified level
• Vulnerability Pattern Detection: Identifies known vulnerable code patterns from the integrated knowledge base
• Cross-Source Correlation: Maps findings to ASVS requirements, API Top 10 risks, CheatSheet guidance, and WSTG test IDs
• Severity Classification: Rates findings as Critical/High/Medium/Low with evidence and confidence
• Remediation Guidance: Provides concrete fix patterns sourced from CheatSheet Series
• Structured Report Generation: Produces a comprehensive Markdown audit report

Audit Workflow

1. Reconnaissance    → Identify stack, structure, entry points
2. Scope Definition  → Select applicable ASVS domains and level
3. Domain Analysis   → Audit each security domain systematically
4. Finding Synthesis → Deduplicate, correlate across sources, assign severity
5. Remediation Map   → Attach fix patterns per finding
6. Report Generation → Produce structured Markdown report

Output Contract

The audit produces a Markdown report containing:

• Executive Summary: Overall risk posture, critical findings count, audit scope
• Findings Table: Each finding with severity, ASVS ID, CWE, evidence, and remediation
• Domain Reports: Per-domain detailed analysis with code references
• Remediation Roadmap: Prioritized fix recommendations
• Audit Metadata: Scope, level, limitations, methodology notes

Severity Levels

Level	Criteria
Critical	Exploitable vulnerability with direct security impact (RCE, SQLi, auth bypass, data breach)
High	Significant security weakness requiring prompt remediation (broken access control, weak crypto, SSRF)
Medium	Security concern with conditional exploitability (missing headers, verbose errors, weak validation)
Low	Defense-in-depth improvement or best practice deviation (logging gaps, minor config issues)
Info	Observation or recommendation with no direct security impact

Technical References

• audit_process.md: Complete step-by-step audit methodology and reconnaissance procedures
• security_domains.md: All 17 ASVS domains with code-audit-relevant requirements and cross-source mappings
• vulnerability_patterns.md: Concrete code-level vulnerability patterns organized by category
• remediation_patterns.md: Secure coding fix patterns from CheatSheet Series
• report_format.md: Detailed Markdown report structure and finding schema