Audit Security
audit_securityScan frontend source code to identify shipped security defects—missing CSP and HSTS, exposed secrets, unsafe scripts—with actionable findings and severity ratings.
Instructions
Audit a web project or snippet for security defects a frontend actually ships: missing or weak Content-Security-Policy, absent HSTS, unpinned cross-origin scripts, mixed content, credentials in localStorage, secret-named NEXT_PUBLIC_/VITE_ variables, unsandboxed third-party iframes, wildcard postMessage, raw-HTML sinks with no sanitiser, production source maps and un-ignored .env files. Header state is inferred from wherever your stack declares it — next.config, vercel.json, netlify.toml, _headers, staticwebapp.config.json, firebase.json, Nuxt routeRules, a Remix/React Router headers export, SvelteKit hooks.server.ts and kit.csp, Astro middleware and Next.js middleware or its Next 16 rename proxy.ts, new Response(body, { headers }) and new Headers({…}) on Cloudflare Workers/Deno/Bun — and, as rules rather than places, a quoted header-name property in any JSON or object literal, and any call whose method name is set, setHeader, append or header whatever the object is called (res.set, res.setHeader, headers.set, headers.append, Fastify reply.header, Hono c.header, Koa ctx.set) — and , read as text and never evaluated. It reads source and does not measure anything: it makes no request to your site, tests no live endpoint, and no finding is or can be a penetration-test or vulnerability-scan result — so do not call it expecting one. Returns markdown plus structured output: findings (rule, severity, message, fix, doc, file, line), a severity summary, and a machine-readable notVisible list of what it could not check. A missing or non-directory path is returned as an error result, not as an empty audit. Pair with audit_project for design drift and audit_accessibility for WCAG.
Input Schema
| Name | Required | Description | Default |
|---|---|---|---|
| code | No | A single snippet to audit instead of a directory. Source rules only. | |
| path | No | Directory to audit. Absolute paths are strongly preferred. Required for configuration and header rules — a snippet cannot show them. | |
| filename | No | Filename for the snippet, e.g. 'page.html' or 'Page.tsx'. Some rules depend on it: an inline onclick is a defect in HTML and normal JSX in a .tsx file. |
Output Schema
| Name | Required | Description | Default |
|---|---|---|---|
| summary | Yes | Counts by severity. Always agrees with `findings` — it is derived from the same list. | |
| findings | Yes | Every finding, in the order the markdown report lists them. | |
| notVisible | Yes | What this audit structurally could not check, one limitation per entry. Read it as a peer of `findings`: silence on a subject named here is this tool's reach, not a clean result. Nothing any of these tools reports is measured. |