security-auditlisted

# /specseal:security-audit — a checklist walked the same way every time A scan finds what it was built to look for. The value of a written checklist is the opposite property: it covers the same ground on a bad day as on a good one. Walk every heading and say `none found` explicitly — a silently skipped section reads exactly like a clean one. **What this checklist assumes.** It describes a service that takes untrusted input over a network: injection through request data, sessions and authorization, data at rest and in transit, deployment configuration. That is the shape of most OWASP material and it is the shape of this file. Other projects have real threats this will not name. A mobile or desktop client worries about local storage, keychain use, certificate pinning, and what a rooted device can read. An embedded target worries about firmware signing and physical access. A library worries about what it does with attacker-controlled input on behalf of its callers, and about its own supply chain. A data pipeline worries about what leaks into logs and derived datasets. Say which of those the project is before walking the list. If the answer is "none of the above", a clean report here means the checklist did not apply — say that instead of reporting a pass. ## OWASP Top 10 Check ### Injection - SQL: parameterized queries used? - XSS: output encoding applied? - Command: user input in shell commands? - Path traversal: file paths validated? ### Authentication & Authorization -