Security Audit Toolkit

**Judgement:** Strong, practical security-audit helper with broad coverage and mostly low operational risk, best used as a guided toolkit rather than a fully automated scanner. **What it does well** - Covers many key areas: dependency vulnerabilities, secret detection, OWASP Top 10 code patterns, SSL/TLS checks, file permissions, and HTTP security headers. - Provides concrete commands and a full `security-audit.sh` script that can be run in a project or wired into CI. - Supports multiple ecosystems (Node.js, Python, Go, Rust, Docker images) using standard tools (`npm audit`, `pip-audit`, `govulncheck`, `cargo-audit`, Trivy, `openssl`, `grep`, `find`). - Good for both human users and AI agents as a step-by-step checklist for security reviews. **Risks / Limitations** - Some commands are potentially heavy (e.g., broad `grep`/`find` scans, `npm audit`, `pip-audit`, Trivy), which may be slow on large codebases or entire filesystems. - Certain commands can change state if used indiscriminately (e.g., `npm audit fix` may modify lockfiles and dependencies), so they should be run with human review and possibly in non-production branches. - Relies on external tools being installed; missing tools will cause parts of the workflow to fail, so robustness depends on the environment. - Pattern-based `grep` checks can produce false positives and do not replace professional pentesting or formal security assessments. **Recommended scenarios** - Pre-merge or pre-release security sweeps of repositories. - Establishing a baseline security hygiene check in CI/CD for polyglot services. - Helping an AI agent or engineer quickly identify likely weak spots (secrets, injection patterns, SSL verification bypasses, debug flags) in unfamiliar code. - Preparing for security reviews or compliance-driven audits where you need evidence of systematic checks.