absolute-audit

Start your first response with the 🔒 emoji.

Absolute Audit

Find and triage security problems across the repo — vulnerable dependencies (CVEs) and risky code patterns — then fix the ones worth fixing, safely. Output is a severity-ranked findings table with a remediation per item, not a raw scanner dump.

Runs the shared engine in references/health-engine.md — read it for the DETECT → SCAN → TRIAGE → FIX → VERIFY → REPORT loop and the safety contract. This file covers only what's specific to security auditing.

Authorized defensive use. This command audits the user's own repository to find and fix weaknesses. It is for hardening, not for attacking systems or evading detection.

---

When to use

• "Run a security audit", "are we vulnerable?", "check our deps for CVEs".
• After a CVE disclosure affecting something you use.
• Periodic hygiene on main.

Distinct from the built-in /security-review (reviews the pending diff on your branch) — audit scans the whole committed repo, deps included. They complement.

---

What it scans

1. Dependency vulnerabilities (CVEs) — primary:

Ecosystem	Scanner
npm / pnpm / yarn	npm audit --json / pnpm audit --json / yarn npm audit --json
Python	pip-audit (preferred) or safety check
Go	govulncheck ./...
Cross-language	osv-scanner against the lockfile if available

2. Code-level patterns — read-only grep/static pass for high-signal issues only: hardcoded secrets/keys/tokens, eval/dynamic exec on input, SQL built by string concatenation, missing authz checks on sensitive routes, disabled TLS verification, unsafe deserialization, overly-broad CORS. Prefer the project's existing SAST/linter security rules (eslint-plugin-security, bandit, gosec) if configured.

Report suspected leaked secrets but never print the secret value — reference path:line and the kind.

---

Risk ranking (TRIAGE)

Rank by severity × exploitability × reachability, not raw CVSS:

Severity	Default
Critical / High, reachable, fix available	fix now (wave 1)
Moderate, reachable	fix this pass
Low / not reachable from app code	report, usually defer
Transitive-only, no direct upgrade path	flag, note the blocking parent

Mark each: is it reachable from the app's actual code paths? A CVE in an unused transitive branch is lower priority than a Moderate one on a hot path. State the fixed version or the mitigation for each.

---

Fix & verify

• Dep CVEs → resolve via the smallest version move that clears it (delegate the actual bump mechanics to the upgrade flow's per-ecosystem steps). Prefer patched minors; escalate to a major only when that's the only fix, and gate it.
• Code issues → apply the concrete fix (parameterize the query, move the secret to env
  • flag the leaked one for rotation, add the authz check). Each fix is its own small wave.
• After each wave, re-run the scanner: the finding must actually disappear, and tests/build stay green. Never resolve by suppressing/allowlisting the alert.
• Leaked live secrets: flag for rotation — removing from code doesn't undo exposure.

---

Gotchas

1. Audit fatigue → blanket ignore. Triage by reachability instead of muting the scanner.
2. Fixing a CVE by suppressing it. An allowlisted advisory is still a vulnerability.
3. Printing the secret. Reference location + type only; never echo the value.
4. Deleting a secret from code ≠ safe. It's in git history and was exposed — rotate it.
5. Stopping at deps. Many real issues are in code, not the dependency tree — run both passes.

---

Companion commands

• /absolute upgrade — does the actual version moves for vulnerable deps.
• /security-review (built-in) — pair with this to also cover your pending diff.
• /absolute work — if remediation is a real refactor (e.g. replacing an auth flow), hand off.