$
copilot --idea "Security Audit Sprint"
→
Run a comprehensive security audit — secrets, CVEs, injection vulnerabilities, and auth weaknesses
The Problem
Security reviews get pushed to "next sprint" indefinitely. When they do happen, they're manual, inconsistent, and miss things. You know there are hardcoded secrets somewhere. You suspect the SQL queries are concatenated strings. You hope nobody uploaded an AWS key to the repo.
What You'll Build
A multi-layer security audit that checks:
- Hardcoded secrets and credentials in code and git history
- Dependency vulnerabilities (CVEs) with severity ratings
- Injection vulnerabilities (SQL, XSS, command injection)
- Authentication and authorisation weaknesses
- A prioritised findings report with remediation steps
Step-by-Step Walkthrough
Layer 1: Secrets Detection
$
"Scan this entire repository for hardcoded secrets:
- API keys, tokens, and passwords in source files
- .env files that were accidentally committed
- Secrets in git history (even if deleted from current code)
- Credentials in configuration files and docker-compose
- Private keys, certificates, and JWT secrets
For each finding, show the file, line number, and how to fix it."
Layer 2: Dependency Audit
$
"Check all dependencies for known vulnerabilities:
- Run npm audit / pip audit / go mod tidy
- Cross-reference with the GitHub Advisory Database
- Show CVE ID, severity (CVSS score), and affected versions
- For each vulnerable package, show the safe upgrade path
- Flag any dependencies that are unmaintained (no commits in 2 years)"
Layer 3: Injection Vulnerabilities
$
"Audit this codebase for injection vulnerabilities:
- SQL injection: find raw string concatenation in queries
- XSS: find user input rendered without escaping
- Command injection: find shell commands built from user input
- Path traversal: find file operations with user-controlled paths
- SSRF: find HTTP requests with user-controlled URLs
For each finding, show the vulnerable code and the fixed version."
Layer 4: Auth Review
$
"Review the authentication and authorisation implementation:
- Are passwords hashed with bcrypt/argon2 (not MD5/SHA1)?
- Are JWT tokens validated properly (expiry, audience, issuer)?
- Is there rate limiting on login endpoints?
- Are sessions invalidated on password change?
- Is CORS configured correctly (not wildcard)?
- Are there any endpoints that should require auth but don't?"
Layer 5: Report Generation
$
"Generate a security audit report with:
- Executive summary (3 sentences)
- Findings table: severity, category, file, remediation
- Risk score (Critical/High/Medium/Low counts)
- Prioritised remediation plan (fix criticals first)
- SARIF format output for GitHub Advanced Security integration"
Pro Tips
• Use the code-review agent — it only surfaces issues that genuinely matter
• Check git history, not just current code — `git log --all -p -S "password"`
• Run this before every major release, not just annually
• The explore agent can scan multiple services in parallel for monorepos
What You'll Learn
• Application security fundamentals (OWASP Top 10)
• Secrets management best practices
• Dependency management and vulnerability remediation
• Security reporting formats (SARIF, CVE)