# Audit report template

The canonical structure for the security audit report. Output to `.forge/work/{type}/{name}/security-audit.md` or surface in the conversation.

```markdown
# Security Audit Report: {Feature/Project Name}

## Metadata
- **Date:** {date}
- **Scope:** {files/components audited}
- **Auditor:** security-reviewer subagent

## Executive Summary
- **Critical findings:** {count}
- **High findings:** {count}
- **Medium findings:** {count}
- **Low findings:** {count}
- **Overall risk:** {Critical / High / Medium / Low}
- **Deployment recommendation:** {BLOCK / PROCEED WITH FIXES / PROCEED}

## Findings

### CRITICAL

#### [SEC-001] SQL Injection in search endpoint
- **Category:** A03 - Injection
- **File:** src/products/repository.ts:45
- **Exploit scenario:** [detailed exploit as shown above]
- **Impact:** Full database read access
- **Fix:** Use parameterized queries
- **Status:** OPEN

### HIGH

#### [SEC-002] Missing rate limiting on login
- **Category:** A04 - Insecure Design
- **File:** src/auth/routes.ts
- **Exploit scenario:** [detailed exploit]
- **Impact:** Account takeover via brute force
- **Fix:** Add rate limiting middleware
- **Status:** OPEN

[...continue for all findings...]

## Dependency Audit
| Package | CVE | Severity | Fix Available | Status |
|---------|-----|----------|---------------|--------|
| lodash@4.17.20 | CVE-2024-XXXX | HIGH | Yes (4.17.21) | OPEN |

## Supply Chain Review
| Package | Risk | Details | Status |
|---------|------|---------|--------|
| express@^4.18.0 | MEDIUM | Unpinned version | OPEN |

## Auth Boundary Map
[Endpoint auth verification table]

## Secrets Scan
| Location | Type | Status |
|----------|------|--------|
| No secrets found in codebase | - | PASS |

## Recommendations
1. [Prioritized list of fixes]
2. [Ordered by severity then effort]

## Quality Gate
**PASS / FAIL**
- Zero critical findings: {PASS/FAIL}
- Zero high findings unaddressed: {PASS/FAIL}
- All dependencies up to date: {PASS/FAIL}
- No secrets in codebase: {PASS/FAIL}
```

## Finding format (for any phase)

When recording an individual finding (in any phase, not just OWASP), use this shape:

```
FINDING: {short title}
FILE: {file:line}
CODE: {the offending snippet}
EXPLOIT: {how an attacker would exploit this — required for MEDIUM and above}
IMPACT: {what attacker gains}
SEVERITY: {CRITICAL | HIGH | MEDIUM | LOW | INFO}
FIX: {concrete remediation}
```

INFO-level findings (best-practice recommendations with no realistic exploit) may omit the EXPLOIT line.