Security Audit: Scope, Access & Dependencies

A security audit is a structured review of a system's configurations, code, processes, and controls against a standard, compliance requirement, or internal policy -- distinct from a penetration test, which actively attempts to exploit specific vulnerabilities rather than systematically reviewing controls.

Access Control: Least Privilege

Auditing access controls checks whether users and systems actually have only the permissions their role needs. Overly broad permissions increase the blast radius if any single account is compromised.

Dependency Review

Outdated third-party libraries may contain publicly known CVEs (Common Vulnerabilities and Exposures) attackers can exploit directly -- checking dependency versions against known-vulnerable releases is a standard, high-value audit step.

Secrets Management

Hardcoded credentials or API keys accidentally committed to a git repository are a common, serious finding -- exposed to anyone with repository access, and often lingering in git history even after later removal from the current code.

Input Validation

Failing to validate/sanitize user input before using it in a query, rendering it in HTML, or passing it to a system command is a root cause of classic vulnerability classes -- SQL injection, XSS, command injection -- so code-focused audits check for this systematically.