Backend Security Audit

Overview

Perform a defensive, evidence-led backend security audit. Find as many real vulnerabilities and risky patterns as possible, report them clearly to the user, then ask whether to implement fixes.

Use this only on systems the user owns or is authorized to assess. Do not provide exploit payloads, attack playbooks, or instructions for compromising third-party systems.

Audit Workflow

1. Establish scope from the repository:

   • Identify backend entry points, framework, package manager, runtime, API routes, middleware, auth/session libraries, database layer, background jobs, file storage, webhook handlers, and deployment files.
   • Read project docs, environment examples, schema files, route definitions, middleware, and dependency manifests before judging individual files.
   • Prefer rg and rg --files for discovery.

2. Load the checklist when needed:

   • Read references/audit-checklist.md before the detailed pass, or when the backend uses unfamiliar patterns.
   • Use it as coverage guidance, not as a substitute for code-specific reasoning.