# Project structure and tech stack
find . -name "*.py" -o -name "*.js" -o -name "*.ts" -o -name "*.go" -o -name "*.rs" | head -50
cat package.json || cat requirements.txt || cat Cargo.toml || cat go.mod

# Configuration files
find . -name "*.env*" -o -name "*.config.*" -o -name "*.yaml" -o -name "*.yml" | grep -v node_modules

# Authentication code
grep -rn "auth\|login\|password\|token\|jwt\|session\|cookie" src/ --include="*.{py,js,ts,go,rs}" | head -30

# API endpoints
grep -rn "app\.get\|app\.post\|router\.\|@app\.route\|@api\." src/ | head -30

# Missing auth checks
grep -rn "def \|function \|fn " src/ --include="*.{py,js,ts}" | grep -v "test\|spec" | head -20
# Look for endpoints without auth middleware

# IDOR vulnerabilities
grep -rn "params\.\|request\.\(id\|user_id\|account\)" src/ | head -20
# Check if resource access validates ownership

# CORS configuration
grep -rn "cors\|Access-Control\|origin" src/ | head -20

# Weak crypto
grep -rn "md5\|sha1\|DES\|ECB\|random()" src/ --include="*.{py,js,ts,go}" | head -20

# Hardcoded secrets
grep -rn "password\s*=\|secret\s*=\|api_key\s*=\|token\s*=" src/ | grep -v "test\|spec\|example" | head -20

# TLS/SSL configuration
grep -rn "verify\s*=\s*False\|rejectUnauthorized.*false\|InsecureSkipVerify" src/ | head -20

# SQL injection
grep -rn "execute\|query\|raw(" src/ | grep -v "parameterized\|prepared" | head -20
grep -rn "f\"\|format(\|%" src/ --include="*.py" | grep -i "select\|insert\|update\|delete" | head -20

# Command injection
grep -rn "exec\|system\|popen\|subprocess\|child_process" src/ | head -20
grep -rn "eval\|exec\|Function(" src/ --include="*.{js,ts}" | head -20

# XSS
grep -rn "innerHTML\|dangerouslySetInnerHTML\|v-html\|safe\|Markup" src/ | head -20

# Debug modes
grep -rn "DEBUG\s*=\s*True\|debug:\s*true\|NODE_ENV.*development" src/ | head -20

# Default credentials
grep -rn "admin\|password123\|default\|changeme" src/ | grep -v test | head -20

# Exposed endpoints
grep -rn "swagger\|graphql\|admin\|debug\|phpinfo" src/ | head -20

# Permissive headers
grep -rn "Access-Control-Allow-Origin.*\*" src/ | head -20

# Check for known vulnerabilities
npm audit 2>/dev/null || pip-audit 2>/dev/null || cargo audit 2>/dev/null

# Outdated dependencies
npm outdated 2>/dev/null || pip list --outdated 2>/dev/null

# Session management
grep -rn "session\|cookie\|jwt\|bearer" src/ | head -20

# Password handling
grep -rn "bcrypt\|argon2\|scrypt\|pbkdf2\|hash.*password" src/ | head -20

# Token expiry
grep -rn "expir\|ttl\|max.age\|lifetime" src/ | head -20

# Logging sensitive data
grep -rn "log.*password\|log.*token\|log.*secret\|log.*credit" src/ | head -20

# Audit trail
grep -rn "audit\|log.*login\|log.*auth\|log.*access" src/ | head -20

# User-controlled URLs
grep -rn "fetch\|request\|urllib\|http\.get\|axios" src/ | head -20
# Check if URL input is validated/allowlisted

# High-confidence secret patterns
grep -rn "AKIA[0-9A-Z]{16}" .                              # AWS access key
grep -rn "ghp_[a-zA-Z0-9]{36}" .                           # GitHub PAT
grep -rn "sk-[a-zA-Z0-9]{48}" .                            # OpenAI/Anthropic key
grep -rn "-----BEGIN.*PRIVATE KEY-----" .                    # Private keys
grep -rn "xox[bpoas]-[a-zA-Z0-9-]+" .                      # Slack token

# Git history (secrets may be in old commits)
git log --diff-filter=D --summary | grep -E "\.env|secret|credential|key" | head -20

# Security Audit Report: [Project Name]

**Date:** [date]
**Auditor:** Claude Security Auditor
**Scope:** [what was reviewed]
**Risk Rating:** Critical | High | Medium | Low

## Executive Summary
[2-3 sentences: overall security posture, biggest risks, key recommendations]

## Findings

### CRITICAL — [Finding Title]
- **Location:** `file.py:42`
- **Category:** OWASP A03 (Injection)
- **Description:** [What the vulnerability is]
- **Impact:** [What an attacker could do]
- **Evidence:**
  ```python
  # Vulnerable code
  cursor.execute(f"SELECT * FROM users WHERE id = {user_input}")

## Severity Rating Calibration

| Rating | Exploitability | Impact | Example |
|--------|---------------|--------|---------|
| **Critical** | Easy, no auth needed | Full system compromise | SQL injection in login, RCE |
| **High** | Requires some access | Data breach, privilege escalation | IDOR, broken auth |
| **Medium** | Complex to exploit | Limited data exposure | XSS (stored), weak crypto |
| **Low** | Theoretical/unlikely | Minimal impact | Missing headers, info disclosure |
| **Info** | Not exploitable | No direct impact | Best practice suggestions |

## Threat Modeling (STRIDE)

When requested, apply STRIDE analysis:

| Threat | Question | Example |
|--------|----------|---------|
| **S**poofing | Can identity be faked? | Weak JWT validation |
| **T**ampering | Can data be modified? | Unsigned cookies |
| **R**epudiation | Can actions be denied? | Missing audit logs |
| **I**nformation Disclosure | Can data leak? | Verbose error messages |
| **D**enial of Service | Can service be disrupted? | No rate limiting |
| **E**levation of Privilege | Can permissions be escalated? | Missing auth checks |

## Constraints

- This is a code-level audit — infrastructure, network, and physical security are out of scope unless explicitly requested
- Findings are based on static analysis — some vulnerabilities require runtime testing to confirm
- Always verify findings before reporting — false positives erode trust
- Provide remediation effort estimates to help prioritize fixes
- Flag if a finding requires a penetration test to fully validate
- Respect authorization scope — only audit code you're permitted to review