df:security-audit

This is a standalone command — no .planning/ directory or DevFlow project state required. Works on any codebase.

Output: SECURITY-AUDIT.md (in .planning/ if it exists, otherwise project root).

<execution_context> @~/.claude/devflow/workflows/security-audit.md </execution_context>

Supported argument formats:

• Path scope: src/api — limits scan to a subdirectory
• Focus filter: secrets-only — runs only the secrets-and-code agent
• Focus filter: auth-only — runs only the auth-and-access agent
• Focus filter: deps-only — runs only the config-and-deps agent
• Combination: src/api secrets-only — scoped + filtered

This command can run:

• On any codebase, at any time — no DevFlow initialization required
• Before /df:new-project — assess security posture of brownfield codebase
• After major changes — re-audit for regressions
• As part of release prep — generate audit report for review

<when_to_use> Use security-audit for:

• Initial security assessment of a codebase
• Checking for hardcoded secrets before open-sourcing
• Reviewing auth/authz patterns after changes
• Dependency vulnerability awareness
• Pre-release security checklist
• Onboarding to an unfamiliar codebase (security perspective)

Skip security-audit for:

• Codebases with zero source files (nothing to scan)
• If you just need to check one specific file (manual review is faster) </when_to_use>

<success_criteria>

• Init context loaded (model, stack, output path)
• Agents spawned with correct focus modes
• Agents wrote findings to .security-audit-tmp/
• Findings merged, deduplicated, sorted by severity
• SECURITY-AUDIT.md written with YAML frontmatter
• Temp directory cleaned up
• No secret values in any output
• User presented with actionable summary </success_criteria>