Security Audit

When to use

• The user needs a ranked OWASP-mapped findings report for a PHP project — injection, CSRF, auth gaps, insecure config — prioritised by ROI so the riskiest cheap fixes come first.
• The user wants to find secrets committed to the repo — API keys, passwords, private keys, tokens in .env, config, or history — and record them as findings.
• The user asks to security-audit or pentest-review an existing PHP codebase for OWASP Top 10 issues, injection, CSRF, broken auth, or misconfiguration, wanting ranked findings.

When NOT to use