Build the threat model and asset inventory first
2-3 hr
Stored XSS in user profile bio field
Reproducible. Owner: Argus. Fix: server-side sanitize on write.
Audit authentication and session management
Half a day
JWT secret hardcoded in dev config
Not in production env, but committed to git. Rotate + scrub history.
Audit access control: IDOR + missing authorization
Half a day to a day
No rate limit on /api/auth/login
Brute-force exposure. Add 5/min/IP via existing rateLimit family.
S3 bucket has overly broad ACL
Public-read on assets bucket; intended. Document explicitly.
Audit injection: SQL, NoSQL, LDAP, command
2-3 hr
Audit input validation, XSS, and CSRF
Half a day
Audit cryptography: passwords, tokens, encryption at rest
2-3 hr
Audit dependencies: CVE scan + supply chain
1-2 hr to scan, varies to remediate
Audit secrets and credentials hygiene
Half a day
Audit logging, monitoring, and incident response
2-3 hr
Write the findings report and remediation plan
Half a day