Security Audit Skill

Systematic security review for any web application. Research-driven, using current OWASP guidelines.

Step 0: Understand the Project

Before auditing, discover the tech stack and attack surface:

1. Read package.json / requirements.txt / go.mod to identify:

• Auth library (next-auth, passport, supabase-auth, django-auth, etc.)
• Database ORM (Prisma, Sequelize, SQLAlchemy, etc.)
• HTTP framework (Express, Fastify, Django, Flask, etc.)
• Any security-specific packages (helmet, cors, csurf, rate-limit, etc.)

2. Identify the auth pattern:

• Session-based vs JWT vs OAuth
• Where tokens are stored (cookies, localStorage, headers)
• How permissions/roles are enforced