Audit rules

How the score works

Every report starts at 100. Each finding lowers the score by its severity, and findings are sorted from most severe.

Open larger image: A security audit

Secrets

The scan covers files tracked by git, up to 1 MB. The value is masked in the report, and lines that look like an example or placeholder are skipped.

Scrollable table

Risky code patterns

These rules skip test and fixture folders. Every finding has a file, a line and a suggested fix.

Scrollable table

Dependencies

The app reads exact versions from package-lock.json, composer.lock, pinned requirements*.txt and poetry.lock, then checks them against OSV.dev. Only package names and versions are sent, never code. Without a network, the audit still finishes with results from the rules.

Accessibility

The page loads in a hidden window, and axe-core runs with the WCAG 2.0, 2.1 and 2.2 tags and best-practice rules. Each rule lists up to eight elements.

axe-core finds only some accessibility problems. Check keyboard use, focus order and alternative text by hand, or with the wcag-audit skill.

SEO

Scrollable table

Send findings to an agent

Select findings and choose Fix with agent. A new or running agent gets a short list of up to 40 items, not the whole report, and it makes no commit.

Security audit for shop found 3 problems. Fix them in the code, starting with the most severe:
1. (critical) GitHub token [scripts/release.sh:12]
2. (high) SQL query built from strings [orders/reports.py:41]
3. (medium) HTML inserted without sanitization [src/components/ProductDescription.tsx:8]