nickcrew/workflow-security-audit

Security Audit Workflow

Comprehensive security assessment process.

Phase 1: Threat Assessment

Agents: security-auditor

Scope:

• Authentication & authorization
• Data protection
• API security
• Dependency vulnerabilities
• Infrastructure security

Output: Threat model, risk assessment, priority list

Phase 2: Automated Scanning

Agents: security-auditor

Tools to run:

• Dependency check (npm audit, pip-audit, cargo audit)
• Static analysis (semgrep, bandit, etc.)
• Secret scanning (trufflehog, gitleaks)

Output: Vulnerability report with severity ratings

Phase 3: Manual Code Review

Agents: security-auditor

Focus areas:

• Input validation
• Output encoding
• Authentication logic
• Authorization checks
• Cryptography usage
• Session management

Phase 4: Penetration Testing

Agents: security-auditor

Test for:

• SQL injection
• XSS attacks
• CSRF attacks
• Authentication bypass
• Privilege escalation

Phase 5: Remediation Planning

Agents: requirements-analyst

• Create fix tasks from vulnerability report
• Prioritize by severity
• Estimate timeline
• Allocate resources

Phase 6: Fix Implementation

Blocking: Validation required before proceeding

Phase 7: Security Validation

Agents: security-auditor

• Retest all identified vulnerabilities
• Regression checks
• Verify fixes don't introduce new issues

Phase 8: Documentation

Agents: technical-writer

• Security audit report
• Compliance documentation
• Security best practices guide

Phase 9: Compliance Check

Agents: security-auditor

Standards:

• OWASP Top 10
• GDPR (if applicable)
• SOC2 (if applicable)
• HIPAA (if applicable)

Success Criteria

• [ ] All critical vulnerabilities fixed
• [ ] All high vulnerabilities fixed
• [ ] Compliance requirements met
• [ ] Security tests pass

Severity Levels

| Level | Response Time | Examples | |-------|---------------|----------| | Critical | Immediate | RCE, auth bypass, data breach | | High | 24-48h | SQL injection, privilege escalation | | Medium | 1 week | XSS, CSRF, information disclosure | | Low | Next sprint | Best practice violations |