Sleep better at night knowing your code is secure. Run enterprise-level security audits that detect vulnerabilities, check OWASP compliance, and identify risks before they become production nightmares.

Quick Start

Jump straight into security analysis with these ready-to-use prompts:

Full Project Security Audit 
Run a comprehensive security audit on my project at C:/web-app
Authentication System Check 
Please audit this auth file for security issues: C:/api/auth/LoginController.php
WordPress Security Review 
Check my WordPress plugin for security vulnerabilities: C:/wp-plugin

Security First

This audit focuses on genuine security risks that could affect production systems. Better to find vulnerabilities during development than in security incident reports.

What It Does

Think of this as having a security consultant review your entire codebase whilst you focus on features. security_audit performs comprehensive vulnerability analysis across entire projects, examining data flows, authentication chains, and cross-file security patterns that single-file analysis might miss.

It goes far beyond basic static analysis by understanding how security vulnerabilities can chain together across multiple files and systems. This isn't just about finding obvious SQL injection opportunities - it's about understanding your application's complete security posture.

The audit examines your code through multiple security lenses:

  • OWASP Top 10 Compliance - Industry-standard vulnerability categories
  • Authentication & Authorization - Login systems, permission checks, session handling
  • Input Validation & Sanitization - XSS prevention, SQL injection, data validation
  • Data Flow Security - How sensitive data moves through your application
  • Cross-File Vulnerability Chains - Security issues that span multiple components
  • Framework-Specific Security - Laravel, WordPress, React security patterns

The analysis is conservative and professional - it focuses on genuine security risks rather than theoretical vulnerabilities, providing actionable findings suitable for security review documentation.

Parameters

Configure your security audit to focus on exactly what matters for your project:

Parameter Type Required Default Description
projectPath string Yes* -

Path to your project root for comprehensive analysis

Example: "C:/web-application"
filePath string Yes* -

Single file to audit (alternative to projectPath)

Perfect for focused authentication system reviews
auditDepth string No "standard"

Analysis depth: "basic", "standard", "comprehensive"

Use "comprehensive" for critical systems
includeOwasp boolean No true

Include OWASP Top 10 vulnerability checks

Essential for compliance and professional security reviews
focusAreas array No []

Specific areas to concentrate on

Options: "authentication", "data-flow", "input-validation", "authorization"
projectType string No "generic"

Project type for specialized security checks

Options: "wordpress-plugin", "wordpress-theme", "react-app", "node-api"

*Either projectPath or filePath is required - choose based on the scope of your security review

Real-World Security Audits

Here's how to run security audits for different scenarios:

Full Application Security Review

Comprehensive Web App Audit 
houtini-lm:security_audit with:
- projectPath: "C:/my-web-app"
- auditDepth: "comprehensive"
- includeOwasp: true
- focusAreas: ["authentication", "data-flow", "input-validation"]

API Endpoint Security Check

Focused API Security Audit 
houtini-lm:security_audit with:
- filePath: "C:/api/routes/payment.js"
- auditDepth: "comprehensive"
- focusAreas: ["input-validation", "data-flow"]
- projectType: "node-api"

WordPress Plugin Security Review

WordPress Plugin Audit 
houtini-lm:security_audit with:
- projectPath: "C:/wordpress-plugins/my-plugin"
- projectType: "wordpress-plugin"
- auditDepth: "comprehensive"
- includeOwasp: true

React Application Security Scan

Frontend Security Review 
houtini-lm:security_audit with:
- projectPath: "C:/react-dashboard"
- projectType: "react-app"
- focusAreas: ["authentication", "input-validation"]
- auditDepth: "standard"

Security Findings You'll Receive

The audit delivers professional-grade security insights ready for security reviews and compliance documentation:

🛡️ OWASP Top 10 Compliance Analysis

Industry-standard vulnerability assessment covering:

  • A01: Broken Access Control - Unauthorised access vulnerabilities
  • A02: Cryptographic Failures - Weak encryption and data exposure
  • A03: Injection - SQL injection, XSS, command injection
  • A04: Insecure Design - Architecture-level security flaws
  • A05: Security Misconfiguration - Default configs, exposed endpoints
  • Plus comprehensive coverage of remaining OWASP categories

🔐 Authentication & Authorization Assessment

  • Session Management - Token handling, session security, logout procedures
  • Password Security - Hashing algorithms, complexity requirements, storage
  • Multi-factor Authentication - Implementation patterns and bypass risks
  • Permission Checks - Role-based access controls and privilege escalation
  • API Authentication - Token validation, rate limiting, endpoint security

⚠️ Input Validation & Sanitization Review

  • XSS Prevention - Cross-site scripting vulnerabilities and prevention
  • SQL Injection Analysis - Database query security and parameterization
  • File Upload Security - Upload validation, type checking, path traversal
  • Form Validation - Client-side vs server-side validation gaps
  • API Parameter Validation - Request validation and error handling

📊 Data Flow Security Analysis

  • Sensitive Data Tracking - How personal data moves through your system
  • Data Exposure Risks - Logs, error messages, debugging information
  • Encryption in Transit - HTTPS implementation, certificate validation
  • Database Security - Connection security, query patterns, access controls
  • Third-party Integrations - External API security and data sharing

🔗 Cross-File Vulnerability Chains

Advanced analysis that identifies security issues spanning multiple files:

  • Authentication Bypass Chains - Multi-step vulnerabilities across components
  • Data Injection Paths - How unsanitized data flows between systems
  • Privilege Escalation Routes - Permission check gaps across modules
  • Session Handling Inconsistencies - Security policy variations

Compliance Ready

All findings are categorized by severity and include remediation guidance suitable for security review documentation and compliance audits.

Security Focus Areas

Tailor your audit to concentrate on specific security concerns:

🔑 Authentication Focus

Deep dive into login systems, session management, and user verification:

  • Multi-factor authentication implementation
  • Session timeout and renewal policies
  • Password reset and recovery mechanisms
  • OAuth and SSO integration security
  • API key management and rotation

📝 Input Validation Focus

Comprehensive review of data sanitization and validation:

  • Form input sanitization and escaping
  • File upload security and type validation
  • API parameter validation and error handling
  • Database query parameterization
  • Content Security Policy implementation

🏛️ Authorization Focus

Role-based access controls and permission systems:

  • Role assignment and privilege validation
  • Resource-level access controls
  • Administrative privilege protection
  • API endpoint authorization
  • Database-level permission enforcement

🌊 Data Flow Focus

Track sensitive information throughout your application:

  • Personal data handling and GDPR compliance
  • Payment information security (PCI DSS)
  • Logging and monitoring data protection
  • Third-party data sharing security
  • Data retention and deletion policies

When Security Audits Save the Day

Here's when this function becomes your security guardian angel:

🚀 Pre-Deployment Security Check

Run comprehensive audits before pushing to production. Catch vulnerabilities in your development environment rather than discovering them through security incident reports or penetration test results.

🏢 Compliance Preparation

Prepare for security audits, compliance reviews, or client security questionnaires. Generate professional security assessment documentation that demonstrates due diligence.

🔄 Legacy System Assessment

Inherited an older codebase? Understand its security posture before making changes. Identify the most critical vulnerabilities and create a prioritized remediation plan.

🛡️ Third-Party Integration Security

Before integrating with external APIs, payment processors, or data sources, ensure your integration points don't introduce new vulnerabilities or expose sensitive information.

📋 Security Code Reviews

Enhance your code review process with automated security analysis. Catch security issues that might be missed during feature-focused reviews.

🎯 Incident Response Analysis

After a security incident, audit related code paths to identify potential attack vectors and ensure comprehensive remediation.

🏆 Security Training & Learning

Use audit results to understand common security patterns, learn about vulnerabilities in your specific technology stack, and improve your security development practices.

Security Audit Best Practices

Get the most comprehensive security insights with these expert recommendations:

🎯 Choose the Right Audit Scope

Match your audit scope to your security concerns:

  • Single File - Authentication systems, payment processing, user input handlers
  • Full Project - Pre-deployment reviews, compliance audits, comprehensive security assessment
  • Specific Components - API endpoints, admin panels, data processing pipelines

⚡ Set Appropriate Audit Depth

  • "basic" - Quick security overview, initial vulnerability screening
  • "standard" - Comprehensive security review, suitable for most production systems
  • "comprehensive" - Deep security analysis for critical systems, compliance requirements

🔍 Focus Areas Strategy

Use focus areas to address specific security concerns:

  • New Features - Focus on "input-validation" and "authentication"
  • API Development - Emphasize "authorization" and "data-flow"
  • Legacy Systems - Use comprehensive review without focus limitations
  • Compliance Reviews - Always include OWASP Top 10 analysis

📋 Integration with Development Workflow

Make security audits part of your regular development process:

  • Run audits on authentication and authorization code before code reviews
  • Audit API endpoints before deployment
  • Review payment and sensitive data handling paths regularly
  • Include security audit results in deployment checklists
  • Use audit findings to create security-focused unit tests

🏆 Professional Security Practices

  • Document Findings - Keep audit results for compliance and incident response
  • Prioritize Remediation - Address high-severity findings first
  • Validate Fixes - Re-audit after implementing security improvements
  • Share Knowledge - Use findings to educate your development team
  • Track Progress - Monitor security improvement trends over time

Security Is Everyone's Responsibility

While automated audits are powerful, they complement rather than replace security expertise. Use findings as a starting point for deeper security analysis and consider professional security reviews for critical systems.

Troubleshooting

Resolve common security audit challenges:

Audit finds too many low-priority issues

The audit is flagging minor issues instead of focusing on genuine security risks.

  • Use specific focusAreas to concentrate on critical security areas
  • Set auditDepth to "standard" for balanced analysis
  • Specify projectType for framework-specific security patterns
  • Focus on OWASP Top 10 findings for industry-standard vulnerability priorities
Missing framework-specific security insights

Not getting WordPress, Laravel, or React-specific security recommendations.

  • Always specify projectType: "wordpress-plugin", "react-app", "node-api"
  • Use "comprehensive" audit depth for detailed framework analysis
  • Include relevant focus areas for your framework (e.g., "authentication" for API projects)
  • Ensure your project structure follows framework conventions
Audit takes too long for large projects

Security audit is slow or times out on large codebases.

  • Start with "basic" audit depth for initial assessment
  • Use specific focusAreas to limit scope
  • Audit critical components individually rather than entire project
  • Ensure LM Studio has sufficient memory and processing power
  • Consider using filePath for high-risk files first
False positives or irrelevant findings

Audit flags issues that don't apply to your specific use case.

  • Specify accurate projectType to get contextually relevant analysis
  • Use targeted focusAreas for your specific security concerns
  • Include context about your deployment environment and usage patterns
  • Focus on high and medium severity findings first
Path errors or permission issues

Can't access project files or directories for security analysis.

  • Use absolute paths: C:/project not ./project
  • Verify paths are within your LLM_MCP_ALLOWED_DIRS configuration
  • Check that all project files have read permissions
  • Start with a smaller subset of files if permission issues persist
Need security audit documentation

How to use audit results for compliance or security documentation.

  • Always include OWASP Top 10 analysis for industry standard compliance
  • Use "comprehensive" audit depth for detailed documentation
  • Focus on high and medium severity findings for executive summaries
  • Include remediation guidance in security improvement plans
  • Re-audit after implementing fixes to demonstrate improvement

Next Steps

Now that you know how to run comprehensive security audits, explore these specialized security functions:

WordPress Security Analysis

Specialized security audits for WordPress plugins and themes

Database Query Security

Deep analysis of SQL injection risks and database security