graph TD
    A[Security Audit] --> B[Requirements Analysis]
    B --> C{Security REQs Complete?}
    C -->|No| D[Flag Missing Requirements]
    C -->|Yes| E[Code Security Scan]

    E --> F[SAST Analysis]
    F --> G[Dependency Scan]
    G --> H[Secret Detection]

    H --> I{Critical Issues?}
    I -->|Yes| J[Block Deployment]
    I -->|No| K[Infrastructure Scan]

    K --> L[IaC Security]
    L --> M[Container Security]
    M --> N[Cloud Config Review]

    N --> O{Security Violations?}
    O -->|Yes| P[Generate Remediation Plan]
    O -->|No| Q[Compliance Check]

    Q --> R{Compliant?}
    R -->|No| S[Flag Compliance Gaps]
    R -->|Yes| T[Threat Modeling]

    T --> U[Identify Threats]
    U --> V[Risk Assessment]
    V --> W[Generate Security Report]

    D --> W
    J --> W
    P --> W
    S --> W

security-audit full-audit \
  --requirements reqs/ \
  --code src/ \
  --infrastructure infrastructure/ \
  --output reports/security/

=== Security Audit Report ===
Date: 2025-01-15
Scope: Full system audit

Overall Security Score: 72/100 (Acceptable)

CRITICAL ISSUES (2):
1. [CWE-89] SQL Injection vulnerability
   - File: src/api/users.py:145
   - Description: Direct string concatenation in SQL query
   - CVSS Score: 9.8 (Critical)
   - Fix: Use parameterized queries
   - Status: BLOCKS DEPLOYMENT ❌

2. [CWE-798] Hardcoded credentials
   - File: src/config.py:23
   - Description: Database password hardcoded in source
   - CVSS Score: 9.1 (Critical)
   - Fix: Use environment variables or secrets manager
   - Status: BLOCKS DEPLOYMENT ❌

HIGH SEVERITY (5):
3. [CWE-200] Information exposure
   - File: src/api/error_handler.py:67
   - Description: Stack traces exposed in API responses
   - CVSS Score: 7.5 (High)
   - Fix: Return generic error messages in production

4. [CVE-2023-12345] Vulnerable dependency
   - Package: requests==2.25.0
   - Vulnerability: Authentication bypass
   - CVSS Score: 8.2 (High)
   - Fix: Upgrade to requests>=2.31.0

5. [CWE-352] Missing CSRF protection
   - File: src/api/forms.py
   - Description: No CSRF tokens on state-changing operations
   - CVSS Score: 8.8 (High)
   - Fix: Implement CSRF token validation

6. [CWE-862] Missing authorization
   - File: src/api/admin.py:89
   - Description: Admin endpoint lacks authorization check
   - CVSS Score: 7.5 (High)
   - Fix: Add @require_admin decorator

7. [Container] Running as root
   - File: Dockerfile:15
   - Description: Container runs with root privileges
   - CVSS Score: 7.0 (High)
   - Fix: Create and use non-root user

MEDIUM SEVERITY (12):
... (abbreviated)

LOW SEVERITY (23):
... (abbreviated)

COMPLIANCE STATUS:
✓ OWASP Top 10: 8/10 covered
✗ SQL Injection: Not protected (A03:2021)
✗ Broken Access Control: Partial (A01:2021)
✓ Encryption: TLS 1.3 enforced
✓ Authentication: JWT properly implemented
⚠ Authorization: Missing in 3 endpoints

RECOMMENDATIONS:
1. Fix 2 critical issues immediately (block deployment)
2. Upgrade vulnerable dependencies
3. Implement CSRF protection
4. Add authorization checks to all admin endpoints
5. Review and fix information exposure
6. Container security hardening

NEXT STEPS:
1. Create remediation tickets for all HIGH+ issues
2. Schedule dependency updates
3. Conduct penetration testing after fixes
4. Re-audit in 2 weeks

security-audit requirements \
  --input reqs/security_requirements.md \
  --output reports/security/req-validation.json

{
  "summary": {
    "total_security_requirements": 45,
    "complete": 38,
    "incomplete": 7,
    "coverage_percentage": 84
  },
  "missing_requirements": [
    {
      "category": "Authentication",
      "requirement": "Multi-factor authentication",
      "severity": "high",
      "recommendation": "Add REQ-AUTH-MFA for critical operations"
    },
    {
      "category": "Encryption",
      "requirement": "Encryption key rotation policy",
      "severity": "medium",
      "recommendation": "Define key rotation schedule in REQ-ENC-*"
    }
  ],
  "incomplete_requirements": [
    {
      "id": "REQ-AUTH-01",
      "issue": "No password complexity specification",
      "current": "Password must be secure",
      "recommended": "Password: 8-128 chars, uppercase, lowercase, digit, special"
    }
  ]
}

security-audit dependencies \
  --requirements requirements.txt \
  --output reports/security/dependencies.json

{
  "total_packages": 87,
  "vulnerable_packages": 5,
  "vulnerabilities": [
    {
      "package": "requests",
      "installed_version": "2.25.0",
      "vulnerability": "CVE-2023-32681",
      "severity": "high",
      "cvss_score": 8.2,
      "description": "Proxy-Authorization header leak on cross-origin redirect",
      "fixed_in": "2.31.0",
      "recommended_action": "pip install --upgrade requests>=2.31.0"
    },
    {
      "package": "pillow",
      "installed_version": "9.0.0",
      "vulnerability": "CVE-2023-44271",
      "severity": "critical",
      "cvss_score": 9.8,
      "description": "Arbitrary code execution via crafted image",
      "fixed_in": "9.3.0",
      "recommended_action": "pip install --upgrade pillow>=9.3.0"
    }
  ],
  "license_issues": [
    {
      "package": "some-package",
      "license": "GPL-3.0",
      "issue": "Copyleft license may conflict with proprietary code",
      "recommendation": "Review license compatibility"
    }
  ]
}

security-audit secrets --path . --output reports/security/secrets.json

{
  "secrets_found": 4,
  "files_scanned": 234,
  "secrets": [
    {
      "type": "AWS Access Key",
      "file": "scripts/deploy.sh",
      "line": 15,
      "matched_text": "AKIA...",
      "entropy": 4.5,
      "confidence": "high",
      "recommendation": "Move to AWS Secrets Manager or environment variable"
    },
    {
      "type": "Private Key",
      "file": "config/ssl/private.key",
      "line": 1,
      "matched_text": "-----BEGIN PRIVATE KEY-----",
      "confidence": "high",
      "recommendation": "Remove from Git, use secrets manager"
    },
    {
      "type": "Database Password",
      "file": "src/config.py",
      "line": 23,
      "matched_text": "password = 'SuperSecret123'",
      "confidence": "high",
      "recommendation": "Use environment variables or secrets manager"
    }
  ]
}

# Test: Weak password allowed
def test_weak_password_rejected():
    result = register_user(username="test", password="123")
    assert result.error == "Password too weak"

# Test: JWT token validation
def test_invalid_jwt_rejected():
    response = api_call(headers={"Authorization": "Bearer invalid_token"})
    assert response.status_code == 401

# Test: Session expiration
def test_session_expires():
    token = login_user()
    time.sleep(3600)  # Wait 1 hour
    response = api_call(headers={"Authorization": f"Bearer {token}"})
    assert response.status_code == 401

# Test: User cannot access admin endpoint
def test_user_cannot_access_admin():
    user_token = login_as_user()
    response = api_call("/admin", headers={"Authorization": f"Bearer {user_token}"})
    assert response.status_code == 403

# Test: User cannot access other user's data
def test_user_data_isolation():
    user1_token = login_as_user("user1")
    response = api_call("/users/user2/profile", headers={"Authorization": f"Bearer {user1_token}"})
    assert response.status_code == 403

# Test: SQL injection prevented
def test_sql_injection_prevented():
    malicious_input = "admin' OR '1'='1"
    result = get_user(username=malicious_input)
    assert result is None  # Should not return admin user

# Test: XSS prevented
def test_xss_prevented():
    malicious_script = "<script>alert('XSS')</script>"
    response = create_comment(text=malicious_script)
    assert "<script>" not in response.html
    assert "&lt;script&gt;" in response.html  # Properly escaped

## Threat Model: {Component Name}

### Spoofing
- Threat: Attacker impersonates legitimate user
- Mitigation: JWT with strong signing algorithm (RS256)
- Status: ✓ Implemented

### Tampering
- Threat: Request/response modification in transit
- Mitigation: TLS 1.3 for all communications
- Status: ✓ Implemented

### Repudiation
- Threat: User denies performing action
- Mitigation: Audit logging of all state-changing operations
- Status: ⚠ Partial (missing for some admin actions)

### Information Disclosure
- Threat: Sensitive data exposed in logs/errors
- Mitigation: Sanitize logs, generic error messages
- Status: ❌ Not implemented

### Denial of Service
- Threat: Resource exhaustion through API abuse
- Mitigation: Rate limiting, input validation
- Status: ✓ Implemented

### Elevation of Privilege
- Threat: User gains unauthorized permissions
- Mitigation: RBAC, authorization checks on all endpoints
- Status: ⚠ Partial (missing checks on 3 endpoints)

- [ ] Data minimization implemented
- [ ] User consent mechanism
- [ ] Right to access (data export)
- [ ] Right to erasure (data deletion)
- [ ] Right to portability
- [ ] Data breach notification process
- [ ] Privacy policy published
- [ ] Data protection impact assessment
- [ ] Encryption for personal data
- [ ] Data retention policies defined

Authentication:
- [x] V2.1.1: Password length 8-128 characters
- [x] V2.1.2: Password complexity requirements
- [x] V2.1.3: No password reuse (last 3)
- [ ] V2.1.11: MFA for sensitive operations

Session Management:
- [x] V3.2.1: Session tokens use secure random generator
- [x] V3.2.2: Session token entropy ≥64 bits
- [x] V3.3.1: Session timeout after inactivity
- [ ] V3.3.4: Session invalidation on logout

Access Control:
- [x] V4.1.1: Authorization checked on all endpoints
- [ ] V4.1.5: Access control failures logged
- [x] V4.2.1: Deny by default

Vulnerability Density = Total Vulnerabilities / KLOC
Target: <5 vulnerabilities per 1000 lines of code

Critical Vulnerability Count
Target: 0

Mean Time to Remediate (MTTR)
- Critical: <24 hours
- High: <7 days
- Medium: <30 days
- Low: <90 days

Security Test Coverage = (Security Tests / Total Tests) × 100%
Target: ≥20%

Security Requirement Coverage = (Implemented / Total) × 100%
Target: 100% for MUST requirements

Dependency Vulnerability Coverage = (Scanned Deps / Total Deps) × 100%
Target: 100%