Audit Code for Security Vulnerabilities

Security Auditor systematically reviews application code, dependencies, and infrastructure configuration for security vulnerabilities. It begins by discovering relevant source and configuration files, identifying the technology stack, mapping architecture and entry points, and documenting the attack surface. This establishes the application context before individual suspicious patterns are interpreted as findings.

Its analysis follows OWASP Top 10 categories: broken access control, cryptographic failures, injection, insecure design, misconfiguration, vulnerable components, authentication failures, software integrity failures, logging failures, and server-side request forgery. The categories connect authorization, architecture, dependencies, deployment settings, and monitoring within one audit workflow rather than limiting review to dangerous source functions.

Use it when an application or codebase needs a practical security assessment with actionable remediation. The workflow focuses on exploitable vulnerabilities and business impact. Evaluate each issue within the threat model, environment, and existing controls, so a pattern match is examined in context.

Validate suspected findings to avoid false positives. Evidence should include a source location, code excerpt, component, or configuration example, together with a technical explanation and potential consequences. Critical issues must be distinguished clearly from minor concerns. Current vulnerability information and techniques are verified through search rather than relying only on an installed scanner's result.

Inputs include source files, frameworks, dependencies, application entry points, web-server settings, database configuration, container configuration, and secret-management practices. Static inspection searches for dangerous execution functions, hardcoded credentials, missing input validation, output-encoding problems, error disclosure, and authentication or authorization weaknesses. For example, the weak-cryptography patterns include this literal source expression:

password_hash = hashlib.md5(password).hexdigest()

Configuration review examines nginx or Apache, database access, environment handling, Docker security, and HTTPS/TLS. Dependency assessment identifies known CVEs, outdated packages, missing patches, and supply-chain risks.

The report begins with an executive security posture rating, critical findings, and immediate actions. Each detailed finding carries severity, OWASP category, CVSS score, location, explanation, impact, evidence, remediation, and references. Risk scoring considers exploitability, business impact, environmental factors, and existing protections.

Remediation is prioritized from urgent critical fixes through near-term high-severity changes, architectural prevention, and longer-term program improvements. Broader recommendations address secure coding, tools and processes, training, awareness, and continuous monitoring. The final result gives the development team a clear risk assessment and ordered action plan.

The workflow uses file discovery, text search, file reading, shell commands, and web search. Shell-based dependency checks include npm audit and pip-audit, while external searches cross-reference vulnerability information. These tools support evidence gathering; the report still requires validated findings and specific fix recommendations rather than generic warnings.