codebase-auditlisted

# Codebase Audit — the Inherited-Code Playbook This is the skill that **binds the others together**. Most engagement value from a security review comes from the auditor's process, not from any single check. A junior auditor with a great tool produces a noisy report; a senior auditor with `grep` and a methodology finds the things that matter. This skill is the methodology. It walks the audit from "I just got SSH access / a repo URL" through to "here's the prioritized report with owners and deadlines." It cross-links into every hardening skill in this repo as the deep-dive material per finding class. ## When to invoke - **Inheriting a codebase** — new job, new client, open-source fork, acquisition target - **"Audit my app"** engagement — freelancer / consultancy work - **Onboarding to a project** — you'll touch the code soon and need to know what's safe to assume - **AI-generated codebase review** — before shipping a Claude/Copilot/Cursor-written app - **Periodic re-audit** — annual review of a system you already know ## Step 0 — Scope before substance The most common reason audits fail is the auditor trying to look at everything. Scope discipline is the difference between a useful report and a 300-page document nobody reads. Before starting, write down: - **Why this audit exists** — diligence? incident? compliance? onboarding? - **Who reads the report** — engineers? CTO? legal? buyer? - **Time budget** — 4 hours? 4 days? 4 weeks? This determines depth. - **What's in sc