# /audit — Full Security Audit

## Usage

```
/audit [optional: specific directory or file]
```

## Behavior

Runs a comprehensive security audit using `mk:review` (structural) + `mk:cso` (infrastructure) skills across all platforms detected in the project. Generates a security report.

### Execution Steps

1. **Detect platforms.** Scan the project to identify which platforms/frameworks are in use (e.g., NestJS, Vue, Swift/iOS, Supabase, PostgreSQL).

2. **Run `mk:cso` security audit** for each detected platform. Check for all blocked patterns defined in `rules/security-rules.md`:
   - Hardcoded secrets (API keys, passwords, tokens, JWT secrets in source)
   - `any` type in TypeScript (should use `unknown` + type guards)
   - SQL queries with string interpolation/template literals
   - localStorage for auth tokens
   - v-html with user-provided content
   - UserDefaults for sensitive data (Swift)
   - Row Level Security disabled or missing
   - Controllers without auth guards (unless explicitly public and documented)
   - process.env access without ConfigService wrapper (NestJS)
   - anon key used in server-side context
   - Disabled certificate validation (Swift)
   - CASCADE DELETE without explicit approval

3. **Classify findings** by severity:
   - **PASS**: No issues found in this area.
   - **WARN**: Potential issue that should be reviewed but does not block shipping.
   - **BLOCK**: Critical security issue that MUST be resolved before shipping. No exceptions.

4. **Generate security report.** Write to:
   ```
   tasks/reviews/YYMMDD-security-report.md
   ```
   Report includes: per-platform findings, severity per finding, file and line references, remediation guidance.

5. **Print summary.** Display findings grouped by severity:
   ```
   🐱 Security Audit Results:
   BLOCK (2): [list]
   WARN  (3): [list]
   PASS  (8): [list]
   ```

### Scope

- If a specific directory or file is provided, audit only that scope.
- If no scope is provided, audit the entire project.

### Output

- Security report at `tasks/reviews/YYMMDD-security-report.md`
- Printed summary with per-platform findings and severity levels
- BLOCK findings must be resolved before any `/mk:ship` command will execute
