Source Code Security Audit

ACTION REQUIRED (execute immediately after reading)

1. NOW: Read ../field-journal/precedent-pentest.md orcodeAuditAuthorization

2. NOW: Confirm you have source code/repo access（No source binary → switch to RE skill）

3. NOW: Clarify language stack and scope（Directory/Service/PR diff）

4. NEXT: tool-index；semgrep etc.

5. ACT: Threat model sketch → auto scan → manual verification

Scope

• White-box audit, PR/differential security review

• Semgrep / CodeQL / Bandit / gosec etc. SAST

• dangerous API、Injectionpoint、authmissing、EncryptionMisuse

• and supply-chain-security/ division：This skill focuses on proprietary code logic，Supply chain focuses on dependencies and pipelines

Workflow

1. ScopeandThreatmodel

□ Trust boundaries: user input, files, deserialization, SSRF, auth middleware



□ High-value assets: auth, payment, admin panel, key handling

2. automaticScan

semgrep --config auto .



# or项目Rulepackage



semgrep --config p/owasp-top-ten .

3. 人工Verification（MUST）

□ Each SAST hit: reachable? exploitable? false positive?



□ Auth: IDOR/privilege escalation, missing validation, incorrect multi-tenant isolation



□ Injection：SQL/command/Templates/LDAP



□ Crypto: hardcoded keys, ECB, custom crypto

4. 产出

Finding：Location + data flow + PoC + fix recommendation



Optional ATT&CK / CWE ID

Toolchain

| Tool | language/Scenario |

|------|-----------|

| Semgrep | Multi-language quick rules |

| CodeQL | Deep data flow (GitHub) |

| Bandit | Python |

| gosec / staticcheck | Go |

| SpotBugs / FindSecBugs | Java |

References

• references/sast-review-checklist.md

• ../supply-chain-security/ ../api-security/ ../llm-security/（Agent code）

Routing context

Upstream: MASTER R26

Role: ops/role-map.md cae

Downstream: Dependency vulns → supply-chain; runtime verification → pentest-tools

Task completion checklist

• Did you manually verify rather than only pasting scanner output?

• Does it include fix recommendations?

• Is it limited to the authorized repo scope?

• Checklist？