loom-security-audit

# Security Audit Deep, methodical security review producing evidenced, severity-ranked, remediable findings — the heavyweight companion to `loom-security-scan` (fast tooling). Delegates: STRIDE/architecture → `loom-threat-model`; authn/authz mechanisms → `loom-auth`; dependency/SBOM/supply-chain → `loom-dependency-scan`. ## Method 1. **Scope** — assets, data classification, compliance obligations, threat model (pull from `loom-threat-model`). Define what "in scope" means before touching anything. 2. **Review by layer** — app code, APIs, infra/IaC, data pipelines, ML (sections below). 3. **Evidence** — every finding cites `file:line` or config path + a concrete exploit scenario. A finding without a repro is a guess. 4. **Rate** — CVSS or Likelihood×Impact; rank most-severe first. 5. **Remediate** — specific fix (ideally a diff), not "sanitize inputs". 6. **Report** — executive summary + technical detail + prioritized remediation. Run tooling first (`loom-security-scan`) to clear known-pattern noise, then spend human effort on **logic and authorization flaws that scanners miss** — that's where audits earn their keep. ## OWASP Top 10 (2021) — audit lens | # | Category | First things to check | | - | -------- | --------------------- | | A01 | Broken Access Control | IDOR/BOLA, missing function-level authz, path traversal, CORS, force-browsing. **Most common; start here.** → `loom-auth` | | A02 | Cryptographic Failures | Plaintext/weak-hash secrets, TLS < 1.2, weak ciphers, ...