Run a comprehensive security audit across application code, cloud infrastructure, containers, CI/CD pipelines, and infrastructure-as-code. Covers privacy compliance, OWASP basics, secret leakage, API security, IAM misconfigurations, storage exposure, Kubernetes hardening, and network security. Use when the user asks to audit, review, or harden app or cloud security, check for secrets, scan for XSS/SQLi, verify security headers, review Terraform/CloudFormation, audit AWS/GCP/Azure configs, or…
Collected from public GitHub. Every version is saved exactly as it was and never changes. Install it at an exact version with the mdr tool, and every file is checked before it reaches your agent. The main file is checked against the SHA-256 fingerprint recorded here, and the others against the fingerprints GitHub keeps for its source commit. The automatic checks below grade the latest version, and the same checks always give the same file the same grade.
What the file says
# Security Audit Checklist
Run these checks on any system before shipping to production or after major changes.
## Before you start
The checklist itself is prose and needs nothing. The three scanners under
`scripts/` are Python, so running those needs **Python 3** on your machine
(`python3 --version`). Without it you can still work the checklist by hand; you
just do not get the automated secret scan, header check and IaC read.
## 1. Privacy & Data Governance
- [ ] **Privacy policy exists** if the app collects, stores, or processes any user data. Link it in the footer and signup flows.
- [ ] **Know where user data is stored**: document the primary database, caches, logs, backups, and third-party services. Check data residency requirements (GDPR, CCPA).
- [ ] **Data minimization**: only collect what you need. Delete or anonymize data you do not use.
## 2. Secret & Key Hygiene
- [ ] **.env values are not leaking**: scan the full repo for hardcoded secrets.
- [ ] **Never expose API keys in frontend code**: no keys in JS bundles, no sensitive values in public env prefixes (`REACT_APP_`, `NEXT_PUBLIC_`, `VITE_`).
…
The line at the top of this page pins the label git:20260910.badf951, which is what most people want. This one pins the sha256 fingerprint of the contents instead, so it survives a label being moved. Either way the exact version is written to mdr.lock, and mdr install downloads and checks those contents again, so it installs them exactly or stops with an error.
GET https://markdownregistry.com/api/v1/artifacts/art_lmfhl4sul2ainbfn
GET https://markdownregistry.com/api/v1/resolve?ref=getedgehq/skills/security-audit-checklist
GET https://markdownregistry.com/api/v1/blob/c9b66bff8f40e8a393f3e942355239d6a4e970e9df0dc55ab54928ed87732861
Your AI assistant does the legwork. You hear about the deals worth your word. Hand yours the standing instructions at modelranch.com and it joins the network that reads files like this one.
getedgehq/skills · abel-sell-the-alpha/SKILL.md · Build an account-specific enterprise sales brief using Jen Abel's buyer-advantage method. Use for founder-led…
getedgehq/skills · agent-governance-gap-analysis/SKILL.md · Score an organisation's AI agent governance against 25 technical checks across 7 dimensions — agent inventory…
getedgehq/skills · agent-infra-fixer/SKILL.md · Fix the agent's own environment when skill-miner surfaces infra-class failures - broken or over-broad hooks…
getedgehq/skills · agent-receipt/SKILL.md · Create a compact, evidence-backed proof-of-work receipt for a completed AI agent run. Use when the user wants to…
getedgehq/skills · ai-dna/SKILL.md · Turn your own local ChatGPT, Claude Code, and Codex conversation history into a 4:5 AI DNA helix still and 12-second…
getedgehq/skills · ai-festival-poster/SKILL.md · Turn someone's real AI usage into a desert festival lineup poster, painted in Python. Scans local Claude Code and Codex…
getedgehq/skills · ai-team/SKILL.md · Set up a small AI team in Claude Code or Codex: a Chief of Staff that routes work on a board, role agents (product…
getedgehq/skills · albro-founder-brand/SKILL.md · Build a buyer-focused founder narrative, content plan, distribution routine, and revenue hook using Scott Albro's…
getedgehq/skills · anatomy/SKILL.md · Build crafted, highly detailed, interactive isometric SVG figures that explain a technical idea as a real physical…
getedgehq/skills · andy-raskin-strategic-narrative/SKILL.md · Build or review a buyer-centered strategic narrative using Andy Raskin's public method. Use for sales or investor deck…
