Run a security review on code, config, or infrastructure. Use when asked to review for vulnerabilities, before deploying, or when the user mentions security concerns.
When performing a security audit:
npm audit, check Socket.dev for supply-chain risksMap for dynamic keys, avoid obj[userInput]safe-regex2 lintignore-scripts=true in .npmrc? (blocks malicious install scripts)lockfile-lint).env on disk is a flag).env files committed to git?UserNS=keep-id set?NoNewPrivileges=true and DropCapability=ALL?ReadOnly=true where possible?List findings as: [CRITICAL / HIGH / MEDIUM / LOW] — description — suggested fix