Source Code Security Audit

ACTION REQUIRED (Execute Immediately After Reading)

1. NOW

   : Read

   ../field-journal/precedent-pentest.md

   or code audit authorization document

2. NOW

   : Confirm source code/repository access (If only binary without source code → switch to RE skill)

3. NOW

   : Clarify tech stack and scope (directories/services/PR diff)

4. NEXT

   : tool-index; semgrep, etc.

5. ACT

   : Threat modeling sketch → automated scanning → manual verification

Applicable Scenarios

• White-box audit, PR/differential security review
• SAST tools like Semgrep / CodeQL / Bandit / gosec
• Dangerous APIs, injection points, missing authentication, improper encryption usage
• Division of work with

  supply-chain-security/

  : This skill focuses on in-house code logic, while supply chain focuses on dependencies and pipelines

Workflow

1. Scope and Threat Modeling

□ Trust boundaries: user input, files, deserialization, SSRF, authentication middleware
□ High-value assets: authentication, payment, admin panel, key handling

2. Automated Scanning

semgrep --config auto .
# Or project rule package
semgrep --config p/owasp-top-ten .

3. Manual Verification (MUST)

□ Each SAST hit: Reachability? Exploitability? False positive?
□ Authentication: IDOR/permission bypass, missing validation, incorrect multi-tenant isolation
□ Injection: SQL/command/template/LDAP
□ Encryption: hardcoded keys, ECB, custom crypto

4. Deliverables

Finding: Location + Data Flow + PoC + Fix Recommendations
Optional ATT&CK / CWE IDs

Toolchain

References

• references/sast-review-checklist.md

• ../supply-chain-security/

  ../api-security/

  ../llm-security/

  (Agent code)

Routing Context

ops/role-map.md

Task Completion Self-Check

• Is manual verification done instead of just pasting scanner outputs?
• Are fix recommendations included?
• Is it limited to the authorized repository scope?
• Checklist completed?