ShaheerKhawaja/productionos-security-audit

productionos-security-audit

Use this alias when you want the same workflow through a top-level Codex-safe name without the productionos: namespace.

Overview

Use this as the Codex-first security audit workflow. It is detection-first and evidence-first: find concrete security issues, map them to frameworks, and never cross into exploit behavior.

Source references:

• .claude/commands/security-audit.md
• agents/security-hardener.md

Inputs

• framework: owasp, mitre, nist, or all
• scope: full or changed-files
• repository path or current checkout

Codex Workflow

1. Resolve scope and prior audit context.
2. Audit the codebase across the main security domains:
   • access control
   • crypto and secrets handling
   • injection risk
   • security misconfiguration
   • dependency and supply-chain risk
   • auth/session weaknesses
   • logging, monitoring, and SSRF-style outbound risk
3. Map every real finding to a framework category where possible.
4. Classify severity and explain exploitability and impact.
5. End with an actionable posture summary, not just a list of grep hits.

Expected Output

• findings with severity, evidence, and framework mapping
• overall security posture summary
• concrete remediations

Guardrails

• never attempt live exploitation
• never expose secret values in output
• every finding must be backed by file and line evidence