security-audit-standard

Follow a phased process: scan for hardcoded secrets, verify input validation on every endpoint, check authentication and session handling, audit dependencies with tools like npm audit or cargo audit, and review infrastructure configuration. Document findings in a severity-ranked report.

Grep tracked source files for patterns like sk-, ghp_, token, password, and connection strings such as mongodb:// or webhook URLs. Verify .gitignore covers .env files, .pem, .key, and credentials files, and rotate any exposed keys immediately.

Use npm audit or pnpm audit for Node.js, cargo audit and cargo deny for Rust, pip-audit or safety for Python, and govulncheck for Go. Also check for outdated, abandoned, or typosquatted packages and ensure lockfiles are committed.

Yes, it includes a quick-check table mapping all ten OWASP categories, from broken access control and injection to SSRF and logging failures. Each row pairs the vulnerability class with a concrete verification question.

Tauri audits verify CSP restrictions in tauri.conf.json, enum-constrained IPC commands, disabled dangerous-api features, scoped file system access, and that shell commands are never built from user input.

Classify findings as Critical, High, Medium, or Low based on exploitability and impact. Critical means immediate exploitation with data breach risk, while Low covers defense-in-depth improvements. Order remediation actions by priority in the report.