Security Audit

When to Use

• auditing a web application or API for security issues
• reviewing authentication, authorization, or session handling
• checking input validation, injection risk, or data exposure
• performing a structured hardening and reporting pass before release

Scope and Safety

• Confirm the target, authorized boundaries, and whether testing is read-only or allows active probing.
• Do not run destructive checks, high-volume fuzzing, or denial-of-service style traffic unless explicitly authorized.
• Record assumptions, environment limits, and access level before starting.
• Prefer reproducible evidence over broad claims.

Audit Workflow

Phase 1: Scope and Reconnaissance