vc-security — Security Audit

Output style: Follow process/development-protocols/communication-standards.md — answer-first, plain language, no unexplained jargon, TL;DR on long responses.

Runs a structured STRIDE + OWASP security audit on a given scope. Produces a severity-ranked findings report. With --fix, applies fixes iteratively using the vc-autoresearch guard pattern.

When to Use

• Before a release or major deployment
• After adding auth, payment, or data-handling features
• Periodic security review (monthly/quarterly)
• Compliance check (SOC 2, GDPR, PCI-DSS prep)

When NOT to Use

• Purely cosmetic changes (CSS, copy edits)
• No user-facing code or data handling involved

Modes

Audit Methodology

1. Scope Resolution

Expand the provided glob or full keyword into a file list. Read all in-scope files before analysis.

2. STRIDE Analysis

Evaluate each threat category systematically:

• Spoofing — identity/authentication weaknesses
• Tampering — input validation, integrity controls
• Repudiation — audit logging gaps
• Information Disclosure — data leakage, secret exposure
• Denial of Service — rate limits, resource exhaustion
• Elevation of Privilege — broken access control, RBAC gaps

3. OWASP Top 10 Check

Map findings to OWASP categories (A01–A10). See references/stride-owasp-checklist.md for per-category checks.

4. Dependency Audit

Run the appropriate package audit tool for the detected stack:

• Node.js: pnpm audit
• Python: pip-audit
• Go: govulncheck
• Ruby: bundle audit

5. Secret Detection

Scan for hardcoded API keys, passwords, tokens, and private keys using regex patterns. See references/stride-owasp-checklist.md → Secret Patterns.

6. Finding Categorization

Assign each finding a severity level (see Severity Definitions below).

Output Format

## Security Audit Report

### Summary
- Files scanned: N
- Findings: X critical, Y high, Z medium, W low, V info

### Findings

| # | Severity | Category | File:Line | Description | Fix Recommendation |
|---|----------|----------|-----------|-------------|-------------------|
| 1 | Critical  | Injection | api/users.ts:45 | SQL string concatenation | Use parameterized queries |
| 2 | High      | Auth      | auth/login.ts:12 | No rate limiting | Add express-rate-limit |

Fix Mode (--fix)

When --fix is provided, apply fixes iteratively after the audit:

1. Sort all findings by severity (Critical → High → Medium → Low)
2. For each finding: a. Apply one targeted fix b. Run guard (tests or lint) to verify no regression c. Commit: security(fix-N): <short description> d. Advance to next finding
3. Stop early if guard fails — report the failure instead of proceeding
4. Uses vc-autoresearch guard pattern for regression prevention

Tip: Use --iterations N to cap total fix iterations when scope is large.

Severity Definitions

Integration with Other Skills

• Run after vc-predict when the security persona flags concerns
• Feed Critical/High findings into vc-autoresearch --fix for automated remediation
• Use vc-scenario with --focus authorization for deeper auth flow testing
• Pair with generate-plan / plan-agent to schedule Medium/Low findings as sprint tasks

Example Invocations

# Audit API layer only
/vc-security src/api/**/*.ts

# Audit entire src/ and auto-fix, max 15 iterations
/vc-security src/ --fix --iterations 15

# Full codebase audit (no fix)
/vc-security full

See references/stride-owasp-checklist.md for the detailed per-category checklist and secret detection regex patterns.