Security Audit

Deep, methodical security review producing evidenced, severity-ranked, remediable findings — the heavyweight companion to loom-security-scan (fast tooling). Delegates: STRIDE/architecture → loom-threat-model; authn/authz mechanisms → loom-auth; dependency/SBOM/supply-chain → loom-dependency-scan.

Method

1. Scope — assets, data classification, compliance obligations, threat model (pull from loom-threat-model). Define what "in scope" means before touching anything.
2. Review by layer — app code, APIs, infra/IaC, data pipelines, ML (sections below).
3. Evidence — every finding cites file:line or config path + a concrete exploit scenario. A finding without a repro is a guess.
4. Rate — CVSS or Likelihood×Impact; rank most-severe first.
5. Remediate — specific fix (ideally a diff), not "sanitize inputs".
6. Report — executive summary + technical detail + prioritized remediation.

Run tooling first (loom-security-scan) to clear known-pattern noise, then spend human effort on logic and authorization flaws that scanners miss — that's where audits earn their keep.

OWASP Top 10 (2021) — audit lens