---
description: OWASP + dependency + secret scan of the codebase or diff.
argument-hint: [scope]
---

# /security-audit

## Purpose

Surface security issues: OWASP Top 10, vulnerable deps, leaked secrets, broken authz.

## Required context

- `SECURITY.md`, `docs/compliance/`, `.claude/agents/security-agent.md`

## Inputs

- `$1` — `diff` (default, current branch) or `full`

## Execution steps

1. Secret scan: `.claude/hooks/secret-scan.sh` + gitleaks if available.
2. Deps: `pnpm audit` + `dotnet list package --vulnerable`.
3. Code: check authz on every mutating endpoint, input validation at boundaries, SQL/XSS/SSRF, CORS, security headers.
4. Confirm no secrets in code/config; `.env*` untracked.

## Validation checklist

- [ ] No secrets committed
- [ ] No high/critical dependency vulns (or documented + tracked)
- [ ] Every mutating endpoint authorized
- [ ] Input validated at trust boundaries

## Expected output

Findings by severity with remediation.

## Failure handling

Critical findings block release. Log accepted risks in `docs/compliance/`.
