What problem does it solve? Teams shipping full-stack applications often lack a systematic way to catch dependency vulnerabilities, leaked secrets, and common web security flaws before release. This Skill provides a repeatable audit workflow that produces a structured, dated security report. ## Core Features & Use Cases - Dependency Vulnerability Scanning: Runs pip-audit or safety for Python backends and pnpm/npm audit for frontends, with severity-based response SLAs (Critical within 24h, High within 3 days). - Secret Leakage Detection: Uses truffleHog or gitleaks to scan Git history and code for hardcoded API keys, database passwords, and unignored .env files. - OWASP Top 10 Checklist: Walks through access control, injection, misconfiguration, authentication, SSRF, and frontend XSS checks with concrete verification items. - Use Case: Before a release, run the audit to produce docs/security-audit-{date}.md containing a severity-ranked vulnerability list and per-item remediation advice. ## Quick Start Run a security audit on this repository covering dependency vulnerabilities, leaked secrets, and the OWASP Top 10 checklist, then generate the audit report.
