Security Audit: Multi-Pass Application Security Review

Structured, multi-pass security audit. Combines automated tooling with manual pattern analysis, maps findings to OWASP Top 10:2025, and produces a prioritized report.

Patterns drawn from real OSS incidents (unauthenticated admin endpoints, credential exfiltration, zip slip, auth bypass whitelists, Trivy supply chain compromise) and OpenSSF/SLSA/OWASP standards.

Target versions: see references/versions.md (verified per the receipt date in that file). Do not restate version numbers here.

Scope: TypeScript/JavaScript (Bun, Node.js, Deno), Python, Go, Rust web applications, CLI tools, Dockerfiles, Compose stacks, CI/CD workflows, Helm charts, Terraform, Proxmox/LXC configs, shell scripts. This skill is SAST + config + supply chain. Not DAST or network pentesting.

When to use

• Security review of application code, services, or self-hosted apps
• Secret scanning, dependency audit, auth review, or OWASP-focused assessment
• Supply chain review for build config, CI/CD, containers, or AI-agent integrations
• Pre-release security gate for a repository or deployment artifact

When NOT to use