/dog:cso — Chief Security Officer Audit

Comprehensive security audit with four modes. Each mode produces a structured report section. Run all four for a full posture report, or pick a specific mode.

When to Use

• Before a major release
• After a security incident or near-miss
• When onboarding a new project to understand its security posture
• When /dog:security has been run and you want deeper investigation

When NOT to Use

• As a substitute for a professional security audit on critical infrastructure
• On projects with no git history or no dependency files

Modes

/dog:cso          → all 4 modes
/dog:cso secrets  → Mode 1: secrets archaeology only
/dog:cso supply   → Mode 2: supply chain only
/dog:cso cicd     → Mode 3: CI/CD security only
/dog:cso threat   → Mode 4: threat modeling only

---

Mode 1 — Secrets Archaeology

Scans the full git history for leaked secrets using pattern matching on diffs.

git log -p --all -- . | grep -E \
  'sk-[a-zA-Z0-9]{20,}|ghp_[a-zA-Z0-9]{36}|AKIA[A-Z0-9]{16}|api[_-]?key\s*[=:]\s*["\x27][^"\x27]+["\x27]|-----BEGIN (RSA |EC |OPENSSH )?PRIVATE KEY'

Report section:

## Secrets Archaeology
- Found: N potential secret(s)
  - [COMMIT abc123] file.js line 42: OpenAI API key pattern
  - ...
- Clean: No secrets found in git history ✓

Remediation: for each finding — confirm it's a real secret, rotate it immediately, add to .gitignore, and consider using git filter-repo to remove it from history.

---

Mode 2 — Supply Chain Audit

Runs language-appropriate auditors on dependency files.

Language	Detector	Auditor
JS/TS	package.json	npm audit --json
Python	requirements.txt or pyproject.toml	pip-audit --format json
Go	go.mod	govulncheck ./...
Rust	Cargo.toml	cargo audit

Run all applicable auditors. For each:

npm audit --json 2>/dev/null | jq '.metadata.vulnerabilities'

Report section:

## Supply Chain
- npm: 3 vulnerabilities (1 critical, 2 moderate)
- pip-audit: 0 vulnerabilities ✓
- Not applicable: go.mod, Cargo.toml (not found)

Remediation: upgrade pinned versions for critical/high vulnerabilities. Use npm audit fix / pip install --upgrade / go get -u as appropriate.

---

Mode 3 — CI/CD Security

Scans .github/workflows/*.yml for common security misconfigurations.

Checks:

1. Unpinned actions: uses: actions/checkout@v4 should be uses: actions/checkout@<sha> — detect any action without a full SHA pin
2. Secret exposure: echo ${{ secrets.X }} or run: curl -H "Authorization: ${{ secrets.TOKEN }}" in run steps
3. pull_request_target: workflows using this trigger with ${{ github.event.pull_request.head.sha }} are vulnerable to PWN requests
4. GITHUB_TOKEN over-permission: permissions: write-all or missing permissions block

grep -rn "pull_request_target\|write-all\|secrets\." .github/workflows/ 2>/dev/null
grep -rn "uses:.*@[^0-9a-f]" .github/workflows/ 2>/dev/null  # non-SHA pins

Report section:

## CI/CD Security
- [HIGH] pull_request_target in .github/workflows/ci.yml (PWN request risk)
- [MEDIUM] actions/checkout@v4 not SHA-pinned in .github/workflows/deploy.yml
- [LOW] No permissions block in .github/workflows/lint.yml

---

Mode 4 — STRIDE Threat Modeling

Produces a structured threat model based on the codebase structure.

STRIDE categories:

• Spoofing: authentication, identity verification weaknesses
• Tampering: input validation, data integrity weaknesses
• Repudiation: audit logging gaps
• Information Disclosure: data exposure, verbose error messages, PII leaks
• Denial of Service: rate limiting, resource exhaustion vectors
• Elevation of Privilege: authorization gaps, privilege escalation paths

Process:

1. Read the project entry points (API routes, CLI commands, webhooks)
2. Identify data flows (user input → processing → storage → output)
3. For each STRIDE category, list threats relevant to the detected architecture

Report section:

## Threat Model (STRIDE)

**Spoofing**: [finding or "No issues identified"]
**Tampering**: [finding or "No issues identified"]
**Repudiation**: [finding or "No issues identified"]
**Information Disclosure**: [finding or "No issues identified"]
**DoS**: [finding or "No issues identified"]
**Elevation of Privilege**: [finding or "No issues identified"]

---

Full Report Format

# CSO Security Report — {repo} — {date}

## Executive Summary
Overall risk: HIGH / MEDIUM / LOW
Top 3 issues: ...

## Mode 1: Secrets Archaeology
...

## Mode 2: Supply Chain
...

## Mode 3: CI/CD Security
...

## Mode 4: Threat Model (STRIDE)
...

## Recommended Actions (prioritized)
1. [CRITICAL] ...
2. [HIGH] ...

Verification

A complete CSO run produces 4 non-empty report sections. On a clean repo, each section ends with ✓ or "No issues identified."

Related

• Skill: dog:security-review
• Command: /dog:security
• Agent: security-reviewer
• Rules: common/security