Security.prompt

## Security Audit Framework

### Input Validation
- Are all user inputs validated and sanitized?
- Are there injection vectors (SQL, NoSQL, command, LDAP)?
- Are file paths validated against traversal attacks?

### Authentication & Authorization
- Are auth checks present on all protected routes?
- Are tokens validated correctly (JWT expiry, signature)?
- Is there proper session management?

### Data Protection
- Are secrets stored securely (not hardcoded)?
- Is sensitive data encrypted at rest and in transit?
- Are there data leaks in logs or error messages?

### Common Vulnerabilities
- XSS: Is output properly escaped?
- CSRF: Are anti-CSRF tokens used?
- SSRF: Are outbound requests validated?
- Rate limiting: Are endpoints protected?

### Recommendations
- List vulnerabilities by CVSS severity
- Provide specific remediation for each