Аудит безопасности по STRIDE и OWASP

security

vc-security is a Claude Code skill that runs a structured STRIDE + OWASP Top 10 security audit on a specified scope and can automatically fix discovered vulnerabilities using an iterative guard pattern. The audit covers all six STRIDE threat categories, maps findings to OWASP A01–A10, scans dependencies with the appropriate tool for the detected stack (`pnpm audit`, `pip-audit`, `govulncheck`, or `bundle audit`), and detects hardcoded API keys, tokens, and passwords via regex patterns. Every finding is assigned one of five severity levels — Critical, High, Medium, Low, or Info — and presented in a ranked report with file location and fix recommendation. With `--fix`, the skill applies fixes in severity order, runs a regression guard after each change, and commits with a `security(fix-N):` message; `--iterations N` caps the total number of fix cycles. Suitable for pre-release reviews, periodic security checks, and compliance preparation for SOC 2, GDPR, and PCI-DSS.