Audit template
security
A 14-domain security review where every finding is evidence-backed and exploitability-rated.
Maps to: OWASP · CWE · MITRE · CIS
How this audit works
A specialist swarm runs the 14 security domains in parallel — injection, authentication, authorization, secrets and crypto, supply chain, configuration, IaC, CI/CD, API, business logic, frontend, privacy, logging, and LLM. Phase 0 maps the attack surface and trust boundaries first; each finding cites a file:line or config artifact, maps to OWASP, CWE, MITRE, or CIS, and carries a P0–P3 severity with a CVSS estimate. Every P0/P1 is attacked by independent skeptics before it survives into the report.
Use it when
Before a production launch
You are about to ship and want to know what an attacker could reach. The audit maps entry points and trust boundaries, then surfaces unauthenticated mutating endpoints, IDOR/BOLA gaps, and exposed secrets as P0s — each with the concrete exploitation path and a before/after fix.
Auditing an inherited codebase
You took over a service with no security history. The swarm builds an attack-surface inventory from scratch and grades all 14 domains A–F, so you learn where the real exposure sits — weak JWT validation, over-broad IAM, known-CVE dependencies — instead of guessing.
Hardening a CI/CD and IaC setup
Your pipelines and Terraform have grown organically. The audit checks for secrets in CI, pull_request_target risks, public buckets, missing encryption at rest, and over-broad roles, mapping each gap to a CIS control with a concrete remediation.
What you get
A priority-sorted GitHub tracking issue plus one issue per confirmed finding — each with a management summary, OWASP/CWE/MITRE mapping, redacted evidence, CVSS, and a before/after fix.