Security Audit Standard
Methodology derived from production security audits.
Audit Process
Phase 1: Secret Scanning
Scan for hardcoded credentials in tracked source files.
Targets:
- API keys, tokens, passwords in source (not .env)
- Webhook URLs with tokens
- Database connection strings
- Private keys, certificates
- obfstr!() usage (Rust): still in binary, just obfuscated
Check patterns:
grep -rn "sk-" "pk_" "ghp_" "token" "secret" "password" "apikey"
grep -rn "https
[Description truncada. Veja o README completo no GitHub.]