Security audit

Audit a codebase for security issues with several read-only agents, one per concern, then merge their findings into one report.

warning

Only audit code you're authorized to test: your own code, a pentest engagement in scope, a CTF or defensive analysis. State the scope in every prompt.

Isolate the target

Analyze untrusted code statically in its own workspace. Don't execute, install or build it.

beswarm workspace add --name audit --path ~/audits/vendor-sdk

Split by concern

Start one named, read-only agent per concern, each writing its own report:

beswarm agent start --name supply-chain --agent claude --group audit \
  --prompt "Scope: ~/audits/vendor-sdk only. Read-only: don't edit, run or install anything. Audit dependencies and build scripts for supply-chain risks. Write findings with file:line, severity, impact and a fix to reports/supply-chain.md."
beswarm agent start --name auth --agent codex --group audit \
  --prompt "Scope: ~/audits/vendor-sdk only. Read-only. Audit authentication and session handling. Write findings with file:line, severity, impact and a fix to reports/auth.md."
beswarm agent start --name injection --agent gemini --group audit \
  --prompt "Scope: ~/audits/vendor-sdk only. Read-only. Audit for injection: SQL, command, path and template. Write findings with file:line, severity, impact and a fix to reports/injection.md."
beswarm agent start --name secrets --agent claude --group audit \
  --prompt "Scope: ~/audits/vendor-sdk only. Read-only. Look for hardcoded secrets and credentials. Write findings with file:line, severity, impact and a fix to reports/secrets.md."

Start these in a terminal of the audit workspace so they work in the right directory.

Answer permission prompts yourself

An agent that asks to run a command or edit a file shows as blocked. Read the prompt before deciding:

beswarm agent list
beswarm agent read --name auth --source visible

Treat every permission prompt during security work as your decision. Never auto-answer it.

Merge the findings

When the auditors finish, have one agent de-duplicate and rank everything:

beswarm agent start --name lead --agent claude --group audit \
  --prompt "Merge reports/supply-chain.md, auth.md, injection.md and secrets.md. Remove duplicates, rank by severity, and write reports/audit.md." \
  --wait --timeout 1200

Find the final report with beswarm artifact list, then close the group with beswarm agent close --group audit.