Audit Security

Overview

Perform a structured security audit against the OWASP Top 10, scanning the codebase for injection vulnerabilities, broken authentication, sensitive data exposure, security misconfiguration, and broken access control. Combine automated pattern scanning with manual review of business logic and architecture decisions.

Workflow

1. Read project context — Check .chalk/docs/engineering/ for:

   • Architecture docs (to understand auth patterns, data flow, trust boundaries)
   • Previous security audits (to track remediation progress)
   • API documentation (to identify endpoints requiring auth)
   • Infrastructure docs (to understand deployment security)

2. Determine audit scope — From $ARGUMENTS and conversation:

   • If a specific component or concern is named, focus there
   • If no scope is given, audit the entire codebase
   • Identify the tech stack to tailor the scan patterns (Node.js, Python, Go, etc.)
   • Note the application type: web API, SPA, mobile backend, CLI tool