security-audit

security-audit

Purpose

Ensure security requirements are properly defined, implemented, and tested, and identify vulnerabilities across code, dependencies, infrastructure, and configuration. Validates compliance against recognized standards (OWASP Top 10, CWE, GDPR/HIPAA/SOC 2/PCI DSS where relevant) and performs STRIDE threat modeling. Security requirements trace from SPEC (Layer 6) and the EARS/ADR security topics upstream of it.

When to Use

Use security-audit when:

• Reviewing the security posture of an SDD project or its implementation.
• Validating that security requirements in SPEC (and upstream EARS/ADR) are complete and testable.
• Scanning code, dependencies, infrastructure, or configuration for vulnerabilities, secrets, or compliance gaps.
• Performing threat modeling on a component or system.

Do not use it for general (non-security) artifact quality (use ../quality-advisor/SKILL.md) or traceability validation (use ../trace-check/SKILL.md).

Behavior

The audit runs as a pipeline, producing a single report:

1. Requirements validation — check security requirements (sourced from SPEC and upstream EARS/ADR) for completeness: authn/authz, data protection, encryption, key management; flag missing or vague requirements.
2. Code scanning — SAST (bandit, semgrep), dependency CVEs (safety, pip-audit), secret detection (detect-secrets, gitleaks), and pattern checks for injection, XSS, and CSRF. Critical findings block deployment.
3. Infrastructure scanning — IaC (checkov, tfsec), containers (trivy, grype), Kubernetes, and cloud/network configuration.
4. Dependency assessment — known CVEs, CVSS scoring, outdated and transitive packages, and license-compliance issues.
5. Compliance check — OWASP Top 10 (2021) coverage and CWE mapping, plus any applicable regulatory frameworks.
6. Threat modeling — STRIDE analysis, attack-surface and trust-boundary mapping, with mitigation status per threat.
7. Report — overall security score, findings grouped by severity (critical/high/medium/low) with file:line, CWE/CVE, CVSS, and fix, plus compliance status and prioritized remediation. Critical issues are marked as deployment blockers.

Targets: zero critical vulnerabilities, no secrets in the repository, 100% coverage of MUST security requirements, OWASP Top 10 fully covered.

Limitations: cannot detect all business-logic flaws, may produce false positives requiring manual review, and depends on current tool vulnerability databases.

Related Resources

• SPEC layer: framework/layers/06_SPEC/README.md · framework/layers/06_SPEC/SPEC-TEMPLATE.yaml
• Upstream security topics: framework/layers/03_EARS/README.md · framework/layers/05_ADR/README.md
• Governance: framework/governance/ (ID, tagging, traceability standards)
• Related skills: ../quality-advisor/SKILL.md · ../trace-check/SKILL.md · ../doc-spec/SKILL.md
• References: OWASP Top 10 (2021), CWE, OWASP ASVS