audit-security
Installation
SKILL.md
Security Audit
Static Websites on cPanel — External Webhook Integration
A static marketing site has a significantly smaller attack surface than a web application with a backend. There is no database to inject, no authentication to break, no sessions to hijack. However, specific vulnerabilities exist in this context — a public site on shared hosting with external webhooks — that must be verified before launch.
Scope: static marketing site + interactive demo with external webhook integration.
Out of scope: backend platform vulnerabilities (user authentication, data isolation, role permissions). That requires a separate audit of the production system.
Severity Levels
| Level | Description | Action |
|---|---|---|
| Critical | Sensitive data exposure or exploitable attack vector | Fix before launch |
| High | Significant security weakness without obvious immediate exploit | Fix before launch |
| Medium | Suboptimal configuration that reduces security posture | Fix in first week |
| Low | Best practice improvement with minor impact | Fix when convenient |