vc-security, Security Audit

Output style: Follow process/development-protocols/communication-standards.md, answer-first, plain language, no unexplained jargon, TL;DR on long responses.

Runs a structured STRIDE + OWASP security audit on a given scope. Produces a severity-ranked findings report. With --fix, applies fixes iteratively using the vc-autoresearch guard pattern.

When to Use

• Before a release or major deployment
• After adding auth, payment, or data-handling features
• Periodic security review (monthly/quarterly)
• Compliance check (SOC 2, GDPR, PCI-DSS prep)

When NOT to Use

• Purely cosmetic changes (CSS, copy edits)
• No user-facing code or data handling involved

---

Modes

Mode	Invocation	Behavior
Audit only	/vc-security <scope>	Scan → categorize → report
Audit + Fix	/vc-security <scope> --fix	Scan → categorize → fix iteratively
Bounded fix	/vc-security <scope> --fix --iterations N	Limit fix iterations to N

---

Audit Methodology

1. Scope Resolution

Expand the provided glob or full keyword into a file list. Read all in-scope files before analysis.

2. STRIDE Analysis

Evaluate each threat category systematically:

• Spoofing, identity/authentication weaknesses
• Tampering, input validation, integrity controls
• Repudiation, audit logging gaps
• Information Disclosure, data leakage, secret exposure
• Denial of Service, rate limits, resource exhaustion
• Elevation of Privilege, broken access control, RBAC gaps

3. OWASP Top 10 Check

Map findings to OWASP categories (A01, A10). See references/stride-owasp-checklist.md for per-category checks.

4. Dependency Audit

Run the appropriate package audit tool for the detected stack:

• Node.js: pnpm audit
• Python: pip-audit
• Go: govulncheck
• Ruby: bundle audit