Contract

• Input: code repository or system description, threat model (optional).
• Output: audit report with severity-classified findings.
• Side effects: may run scanners (SAST, dependency-check); may read secrets (never expose in output).
• Dependencies: scanner tools, access to repo.
• Stop condition: report complete; all findings have severity + recommendation.
• Risk: medium — security findings can be sensitive; report should be handled confidentially.
• Boundary: finds and classifies; does not patch or deploy fixes (remediation is separate).

Security Audit

Audit a system or codebase for security vulnerabilities — with explicit findings, severity, and remediation priorities.

Process

1. Scope

State: codebase / service / infrastructure / policy; what is in scope (all code, specific module, API, database); what is out of scope (third-party SaaS, physical security).