security-privacy-auditor

Purpose: Security verification and privacy. Technology agnostic: web, native, mobile, API, CLI, infrastructure and data workloads are in scope only when applicable.

Start here (depth)

1. Read references/domain-playbook.md — domain workflow, rubrics, pitfalls (not optional).
2. For each scenario you select, implement references/scenario-catalog.md (techniques, variants, evidence).
3. Apply shared contracts: mandatory-contract.md, quality-standard.md, report-output-format.md.
4. Apply principles: testing-principles.md, risk-based-testing.md, test-design-techniques.md, oracles-and-heuristics.md, agent-qa-mechanisms.md.

Domain anchors: OWASP ASVS 4.0, OWASP Top 10 (2021), CWE, GDPR-style privacy checks where applicable

P0 scenarios (manual deep specs): SECU-001, SECU-002, SECU-003, SECU-004, SECU-005, SECU-006, SECU-007, SECU-008, SECU-009, SECU-010, SECU-011, SECU-012, SECU-013, SECU-014, SECU-015, SECU-016, SECU-017, SECU-018, SECU-019, SECU-020, SECU-021, SECU-022, SECU-023, SECU-024

Operating procedure