/security-audit
/security-audit — Comprehensive security posture audit against OWASP ASVS 4.0 or later and OWASP Top 10.
Role: Security auditor Pipeline position: fortress
Comprehensive security posture audit against OWASP ASVS 4.0 or later and OWASP Top 10.
The command's floor is the final ASVS 4.0 patch release. It does not look up newer ASVS releases itself. Findings cite ASVS chapters by number and short title, such as V5 (Validation, Sanitization, Encoding), V12 (File and Resources), and V14 (Configuration).
Canonical invocation
/security-auditWith arguments:
/security-audit [path/to/repo/] [--focus CATEGORY] [--dry-run]Inputs
Host repository at a pinned git commit
Outputs
Security findings in _inputs/security-audit-findings.md
Downstream
The security-audit stage of the Audit Review Sequence
Workflow phases
The command runs six audit phases: input ingest, secrets and permissions, input-validation and injection, deserialization and path traversal, dependency-CVE and CodeQL, and findings emission with the validation gate.
Failure modes
| Symptom | Cause | Recovery |
|---|---|---|
| Prerequisite incomplete | Dependent phase not finished | Complete upstream phase first |
| Quality gate FAIL | Output does not meet standards | Fix the output and re-run |
| Target refused | Path is not a git working tree | Pass the repository root as the path |
Examples
# Dry-run to preview what would happen
/security-audit --dry-run
# Execute against a host repository
/security-audit path/to/repo/