audit-security

A security audit that the operator will actually read.

Enterprise scanners emit hundreds of warnings. Non-developers silence them within a week and then a real vulnerability slips through because nobody's reading anymore. The opposite strategy works better: a short, hand-curated list of patterns that are almost always actionable, each one triaged individually. Every hit gets classified. Every classification has a reason.

The rule

Never report more than ~20 findings. If the automated sweep returns 100 hits, triage them into categories and report the categories, not the raw list. The operator's attention is the scarcest resource and the wrong optimization is "comprehensive."

When to trigger

Any of:

• "is this safe"
• "security check" / "security audit"
• "are there any vulnerabilities"
• "any secrets leaked"
• "is my .env exposed"