Prompt file imported from Shamail/ai-coding-template (.windsurf/workflows/run_security_audit.md). Copyright stays with the author.

AI-Assisted Security Audit Workflow

Overview

This workflow outlines integrating AI into the security audit process. AI can assist in analyzing code for vulnerabilities, interpreting security scan results, and formulating remediation plans, complementing traditional security tools and human expertise.

Note: This is a foundational workflow. Specific AI tools, advanced prompts, and integration with SAST/DAST tools will be detailed further. Always refer to security_guidelines.md.

Prerequisites

• Defined scope for the security audit (e.g., specific application, module, or feature).
• Access to relevant code, configuration files, and deployment manifests.
• Results from existing security scanning tools (SAST, DAST, dependency checkers), if available.
• Access to approved AI coding/security assistant tools.
• Familiarity with prompt_engineering_guidelines.md and security_guidelines.md.

Steps

1. Define Audit Scope and Objectives:

   • Clearly identify the systems, code, or components under audit.
   • Define specific security objectives (e.g., identify OWASP Top 10 vulnerabilities, check compliance with security_guidelines.md).

2. AI-Assisted Code Review for Vulnerabilities:

   • Provide AI with specific code snippets or modules.
   • Prompt Examples:
     • "Review this code for potential SQL injection vulnerabilities: [code snippet]."
     • "Analyze this authentication module for common security flaws according to OWASP ASVS: [code snippet]."
     • "Does this file upload handling code protect against [specific threats, e.g., path traversal, unrestricted file upload]?"
   • Focus on areas highlighted in security_guidelines.md.

3. Interpret Security Scan Results with AI:

   • If using SAST/DAST tools, provide AI with their findings.
   • Prompt Examples:
     • "Explain this SAST tool finding: [tool output/warning]. What is the potential impact and how can it be mitigated?"
     • "Prioritize these DAST findings based on potential exploitability and impact: [list of findings]."

4. AI-Assisted Remediation Planning:

   • Use AI to help draft remediation plans or generate secure code examples.
   • Prompt Examples:
     • "For the identified XSS vulnerability [details], suggest a secure code fix in [language/framework]."
     • "Outline a remediation plan for addressing the dependency vulnerabilities found by [tool name]."

5. Human Verification and Reporting:

   • Crucially: All AI suggestions (identified vulnerabilities, fixes) MUST be verified by human security experts/developers. AI can produce false positives or incomplete solutions.
   • Compile a final audit report, incorporating verified AI findings and human analysis.
   • Prioritize remediation efforts based on risk.

Output

• A security audit report detailing findings (both AI-assisted and human-identified), risk levels, and recommended remediations.
• Actionable steps for developers to address identified vulnerabilities.
• Improved understanding of the application's security posture.