vcsecurity

# vc:security — Security Audit Runs a structured STRIDE + OWASP security audit on a given scope. Produces a severity-ranked findings report. With `--fix`, applies fixes iteratively using the vc:autoresearch guard pattern. ## When to Use - Before a release or major deployment - After adding auth, payment, or data-handling features - Periodic security review (monthly/quarterly) - Compliance check (SOC 2, GDPR, PCI-DSS prep) ## When NOT to Use - Purely cosmetic changes (CSS, copy edits) - No user-facing code or data handling involved --- ## Modes | Mode | Invocation | Behavior | |------|-----------|----------| | Audit only | `/vc:security <scope>` | Scan → categorize → report | | Audit + Fix | `/vc:security <scope> --fix` | Scan → categorize → fix iteratively | | Bounded fix | `/vc:security <scope> --fix --iterations N` | Limit fix iterations to N | --- ## Audit Methodology ### 1. Scope Resolution Expand the provided glob or `full` keyword into a file list. Read all in-scope files before analysis. ### 2. STRIDE Analysis Evaluate each threat category systematically: - **S**poofing — identity/authentication weaknesses - **T**ampering — input validation, integrity controls - **R**epudiation — audit logging gaps - **I**nformation Disclosure — data leakage, secret exposure - **D**enial of Service — rate limits, resource exhaustion - **E**levation of Privilege — broken access control, RBAC gaps ### 3. OWASP Top 10 Check Map findings to OWASP categories (A01–A10). See `ref...