Web Security Audit

engineering

Web Security Audit is a Claude Code skill that audits a web application and its deployment for the vulnerability classes that actually hit small projects, returning findings ranked by severity with the exact location and the fix. Call it before launch or when you suspect holes. Gated steps: map inputs and outputs, injection (XSS, SQL, command, path traversal), IDOR and per-object authorization, CSRF, SSRF, file uploads, open redirects, data exposure, password storage (Argon2id, bcrypt with an explicit cost), cookie flags and SameSite, token revocation on logout, and CSP, HSTS and CORS headers with Origin reflection probed through curl. Severity uses an S1 to S3 scale. An LLM first pass is allowed, but every finding must be reproduced. The skill states what is out of scope: business logic, race conditions, IAM. You get a report with location, exploit, fix and verification for each finding.