Security Scanning

Security Scanning

Automate vulnerability detection in code and dependencies.

Dependency Scanning

JavaScript (npm)

# Run audit
npm audit --json > security-audit.json

# Check severity counts
CRITICAL=$(npm audit --json | jq '.metadata.vulnerabilities.critical')
HIGH=$(npm audit --json | jq '.metadata.vulnerabilities.high')

if [ "$CRITICAL" -gt 0 ] || [ "$HIGH" -gt 0 ]; then
  echo "🚨 $CRITICAL critical, $HIGH high vulnerabilities"
fi

# Auto-fix
npm audit fix

Python (pip-audit)

pip-audit --format=json > security-audit.json

# Using safety
safety check --json > security-audit.json

Static Analysis (SAST)

Semgrep

# Run with security rules
semgrep --config=auto --json > semgrep-results.json

# Count findings
CRITICAL=$(cat semgrep-results.json | jq '[.results[] | select(.extra.severity == "ERROR")] | length')

Bandit (Python)

bandit -r . -f json -o bandit-report.json

HIGH=$(cat bandit-report.json | jq '[.results[] | select(.issue_severity == "HIGH")] | length')

Secret Detection

# TruffleHog
trufflehog git file://. --json > secrets-scan.json

# Gitleaks
gitleaks detect --source . --report-format json

# Check results
SECRET_COUNT=$(cat secrets-scan.json | jq '. | length')
if [ "$SECRET_COUNT" -gt 0 ]; then
  echo "🚨 $SECRET_COUNT secrets detected!"
fi

Container Scanning

# Trivy
trivy image myapp:latest --format json > trivy-scan.json

CRITICAL=$(cat trivy-scan.json | jq '[.Results[].Vulnerabilities[]? | select(.Severity == "CRITICAL")] | length')

Pre-commit Hooks (2026 Best Practice)

Shift-left security by catching issues before commit:

# .pre-commit-config.yaml
repos:
  # Secret detection - MUST HAVE
  - repo: https://github.com/gitleaks/gitleaks
    rev: v8.18.0
    hooks:
      - id: gitleaks

  # Python security
  - repo: https://github.com/PyCQA/bandit
    rev: 1.7.7
    hooks:
      - id: bandit
        args: ["-c", "pyproject.toml", "-r", "."]
        exclude: ^tests/

  # Semgrep for SAST
  - repo: https://github.com/semgrep/semgrep
    rev: v1.52.0
    hooks:
      - id: semgrep
        args: ["--config", "auto", "--error"]

  # Detect AWS credentials, private keys
  - repo: https://github.com/Yelp/detect-secrets
    rev: v1.4.0
    hooks:
      - id: detect-secrets
        args: ["--baseline", ".secrets.baseline"]

# Install and setup
pip install pre-commit
pre-commit install

# Run on all files (first time)
pre-commit run --all-files

# Update hooks to latest versions
pre-commit autoupdate

Baseline for detect-secrets (ignore false positives):

# Generate baseline
detect-secrets scan > .secrets.baseline

# Audit false positives
detect-secrets audit .secrets.baseline

CI Integration

# GitHub Actions
- name: Security scan
  run: |
    npm audit --json > audit.json
    CRITICAL=$(jq '.metadata.vulnerabilities.critical' audit.json)
    if [ "$CRITICAL" -gt 0 ]; then
      echo "::error::Critical vulnerabilities found"
      exit 1
    fi

Escalation Thresholds

Evidence Recording

context.quality_evidence.security_scan = {
  executed: true,
  tool: 'npm audit',
  critical: 2,
  high: 5,
  moderate: 10,
  timestamp: new Date().toISOString()
};

Key Decisions

Common Mistakes

• Ignoring audit warnings
• No CI integration
• Not blocking on critical
• Missing secret scanning

Related Skills

• owasp-top-10 - Vulnerability context
• devops-deployment - CI/CD integration
• code-review-playbook - Review process

Capability Details

dependency-scanning

Keywords: npm audit, pip-audit, dependency, vulnerability Solves:

• Scan npm dependencies
• Audit Python packages
• Find vulnerable dependencies

secret-detection

Keywords: secret, credential, api key, trufflehog, gitleaks Solves:

• Detect secrets in code
• Scan for API keys
• Find exposed credentials

api-security-audit

Keywords: api, audit, security, example Solves:

• API security audit example
• Security review checklist
• Real audit walkthrough

audit-template

Keywords: template, audit, report, security Solves:

• Security audit template
• Audit report structure
• Copy-paste audit format

API Security Audit Example

Complete security review of a FastAPI endpoint.

The Endpoint

@router.post("/api/v1/users/{user_id}/transfer")
async def transfer_funds(
    user_id: int,
    amount: float,
    to_account: str,
    db: Session = Depends(get_db)
):
    user = db.query(User).get(user_id)
    user.balance -= amount
    recipient = db.query(User).filter(User.account == to_account).first()
    recipient.balance += amount
    db.commit()
    return {"status": "success"}

Security Issues Found

1. 🔴 CRITICAL: No Authentication

Issue: Endpoint accepts any user_id without verifying caller identity.

Fix:

@router.post("/api/v1/users/me/transfer")
async def transfer_funds(
    amount: float,
    to_account: str,
    current_user: User = Depends(get_current_user),  # JWT/session auth
    db: Session = Depends(get_db)
):

2. 🔴 CRITICAL: No Authorization

Issue: User can transfer from ANY account, not just their own.

Fix: Remove user_id from path, use authenticated user only.

3. 🔴 HIGH: Race Condition

Issue: No transaction isolation. Concurrent requests can overdraw.

Fix:

async def transfer_funds(...):
    async with db.begin():  # Transaction
        user = await db.execute(
            select(User).where(User.id == current_user.id).with_for_update()
        )
        # ... rest of logic

4. 🟡 MEDIUM: No Input Validation

Issue: Negative amounts could credit attacker's account.

Fix:

from pydantic import BaseModel, Field

class TransferRequest(BaseModel):
    amount: float = Field(gt=0, le=10000)  # Positive, max limit
    to_account: str = Field(regex=r'^[A-Z0-9]{10}$')  # Format validation

5. 🟡 MEDIUM: No Rate Limiting

Issue: Attacker can brute-force account numbers.

Fix:

from slowapi import Limiter

limiter = Limiter(key_func=get_remote_address)

@router.post("/api/v1/users/me/transfer")
@limiter.limit("5/minute")
async def transfer_funds(...):

6. 🟡 MEDIUM: Float for Money

Issue: Float precision errors in financial calculations.

Fix:

from decimal import Decimal
amount: Decimal = Field(decimal_places=2)

7. 🟢 LOW: Missing Audit Log

Fix:

await audit_log.record(
    action="transfer",
    user_id=current_user.id,
    amount=amount,
    to_account=to_account,
    ip=request.client.host,
    timestamp=datetime.now(timezone.utc)
)

Secured Version

from decimal import Decimal
from pydantic import BaseModel, Field
from slowapi import Limiter

class TransferRequest(BaseModel):
    amount: Decimal = Field(gt=0, le=Decimal("10000"), decimal_places=2)
    to_account: str = Field(regex=r'^[A-Z0-9]{10}$')

@router.post("/api/v1/transfers")
@limiter.limit("5/minute")
async def transfer_funds(
    request: TransferRequest,
    current_user: User = Depends(get_current_user),
    db: AsyncSession = Depends(get_db)
):
    async with db.begin():
        # Lock sender's row to prevent race conditions
        sender = await db.execute(
            select(User)
            .where(User.id == current_user.id)
            .with_for_update()
        )
        sender = sender.scalar_one()

        if sender.balance < request.amount:
            raise HTTPException(400, "Insufficient funds")

        recipient = await db.execute(
            select(User).where(User.account == request.to_account)
        )
        recipient = recipient.scalar_one_or_none()
        if not recipient:
            raise HTTPException(404, "Recipient not found")

        sender.balance -= request.amount
        recipient.balance += request.amount

        await audit_log.record(
            action="transfer",
            user_id=current_user.id,
            details={"amount": str(request.amount), "to": request.to_account}
        )

    return {"status": "success", "new_balance": str(sender.balance)}

Checklist Summary

• [x] Authentication required
• [x] Authorization enforced
• [x] Input validation (Pydantic)
• [x] Rate limiting
• [x] Transaction isolation
• [x] Decimal for money
• [x] Audit logging
• [ ] Idempotency key (for retries)
• [ ] 2FA for high-value transfers

Security Tool Configurations

Production-ready configurations for security scanning tools.

---

Bandit (Python)

Configuration File

# pyproject.toml
[tool.bandit]
exclude_dirs = ["tests", "venv", ".venv", "migrations"]
skips = ["B101"]  # Skip assert warnings (acceptable in tests)

# Severity and confidence levels
# -ll = low severity and above, -ii = low confidence and above
# Production: use -lll (medium+) -iii (medium+)

[tool.bandit.assert_used]
skips = ["*_test.py", "*test_*.py"]

CLI Usage

# Basic scan with JSON output
bandit -r src/ -f json -o bandit-report.json

# High severity only (CI pipeline)
bandit -r src/ -ll -ii -f json -o bandit-report.json

# Exclude tests and show line numbers
bandit -r src/ --exclude tests/ -n 3 -f txt

# Specific checks only
bandit -r src/ -t B608,B602,B301  # SQL injection, subprocess, pickle

# Generate config baseline
bandit -r src/ -f json | python -c "import json,sys; print(json.dumps({'exclude': list(set([r['filename'] for r in json.load(sys.stdin)['results']]))})" > .bandit.baseline

High-Priority Rules

Detection

# Find SQL injection vulnerabilities
bandit -r . -t B608 --format json | jq '.results[] | {file: .filename, line: .line_number, code: .code}'

# Find command injection
bandit -r . -t B602,B603,B604 --format json

# Count by severity
bandit -r . -f json | jq '.metrics._totals'

---

Semgrep

Configuration File

# .semgrep.yaml
rules:
  # Custom SQL injection rule
  - id: custom-sql-injection
    pattern-either:
      - pattern: |
          $QUERY = f"SELECT ... {$VAR} ..."
          $CURSOR.execute($QUERY)
      - pattern: |
          $CURSOR.execute(f"SELECT ... {$VAR} ...")
    message: "Potential SQL injection. Use parameterized queries."
    severity: ERROR
    languages: [python]
    metadata:
      cwe: "CWE-89"
      owasp: "A03:2021"

  # Hardcoded secrets
  - id: hardcoded-api-key
    patterns:
      - pattern: $VAR = "..."
      - metavariable-regex:
          metavariable: $VAR
          regex: "(api_key|apikey|api_secret|secret_key|auth_token)"
      - metavariable-regex:
          metavariable: $...
          regex: "[a-zA-Z0-9]{20,}"
    message: "Hardcoded API key detected. Use environment variables."
    severity: ERROR
    languages: [python, javascript, typescript]

  # Insecure JWT
  - id: jwt-algorithm-from-header
    pattern: |
      jwt.decode($TOKEN, $SECRET, algorithms=[jwt.get_unverified_header($TOKEN)['alg']])
    message: "JWT algorithm confusion vulnerability. Hardcode the expected algorithm."
    severity: ERROR
    languages: [python]

CLI Usage

# Run with auto config (OWASP rules)
semgrep --config auto --json > semgrep-results.json

# Specific rule packs
semgrep --config "p/python" --config "p/security-audit" .

# CI mode (fail on findings)
semgrep --config auto --error --json -o results.json

# Ignore paths
semgrep --config auto --exclude "tests/*" --exclude "*.test.js" .

# Only specific severity
semgrep --config auto --severity ERROR .

Rule Packs (2026)

# Security-focused packs
semgrep --config p/security-audit     # General security
semgrep --config p/owasp-top-ten      # OWASP Top 10
semgrep --config p/sql-injection      # SQL injection
semgrep --config p/xss                # Cross-site scripting
semgrep --config p/secrets            # Hardcoded secrets
semgrep --config p/jwt                # JWT vulnerabilities

# Language-specific
semgrep --config p/python             # Python security
semgrep --config p/javascript         # JavaScript security
semgrep --config p/typescript         # TypeScript security
semgrep --config p/react              # React security

Detection

# Count findings by severity
semgrep --config auto --json . | jq '[.results[] | .extra.severity] | group_by(.) | map({severity: .[0], count: length})'

# Export findings with file locations
semgrep --config auto --json . | jq '.results[] | {rule: .check_id, file: .path, line: .start.line, message: .extra.message}'

---

npm audit / pip-audit

npm audit

# Basic audit
npm audit

# JSON output for parsing
npm audit --json > npm-audit.json

# Production dependencies only
npm audit --omit=dev

# Specific severity threshold
npm audit --audit-level=high

# Auto-fix (use with caution)
npm audit fix

# Force major version updates (breaking changes possible)
npm audit fix --force

npm audit parsing

# Count vulnerabilities by severity
npm audit --json | jq '.metadata.vulnerabilities'

# List critical/high packages
npm audit --json | jq '.vulnerabilities | to_entries[] | select(.value.severity == "critical" or .value.severity == "high") | {package: .key, severity: .value.severity, via: .value.via}'

# CI gate script
#!/bin/bash
CRITICAL=$(npm audit --json | jq '.metadata.vulnerabilities.critical')
HIGH=$(npm audit --json | jq '.metadata.vulnerabilities.high')

if [ "$CRITICAL" -gt 0 ]; then
    echo "BLOCKED: $CRITICAL critical vulnerabilities"
    exit 1
fi

if [ "$HIGH" -gt 5 ]; then
    echo "BLOCKED: $HIGH high vulnerabilities (threshold: 5)"
    exit 1
fi

echo "PASSED: Security scan"
exit 0

pip-audit

# Install
pip install pip-audit

# Basic scan
pip-audit

# JSON output
pip-audit --format=json -o pip-audit.json

# Scan requirements file
pip-audit -r requirements.txt

# Scan with fix suggestions
pip-audit --fix --dry-run

# Ignore specific vulnerabilities
pip-audit --ignore-vuln PYSEC-2024-1234

# Strict mode (fail on any finding)
pip-audit --strict

pip-audit parsing

# Count vulnerabilities
pip-audit --format=json | jq '. | length'

# List affected packages
pip-audit --format=json | jq '.[] | {name: .name, version: .version, vulns: [.vulns[].id]}'

# CI gate script
#!/bin/bash
VULN_COUNT=$(pip-audit --format=json 2>/dev/null | jq '. | length')

if [ "$VULN_COUNT" -gt 0 ]; then
    echo "BLOCKED: $VULN_COUNT vulnerable packages"
    pip-audit  # Show details
    exit 1
fi

echo "PASSED: No vulnerable packages"
exit 0

---

Secret Detection

Gitleaks Configuration

# .gitleaks.toml
title = "Gitleaks config"

[allowlist]
description = "Global allowlist"
paths = [
    '''(.*)?test(.*)''',
    '''(.*)fixtures(.*)''',
    '''package-lock\.json''',
]

[[rules]]
id = "aws-access-key"
description = "AWS Access Key ID"
regex = '''(?i)aws_access_key_id\s*=\s*['"]?([A-Z0-9]{20})['"]?'''
secretGroup = 1
keywords = ["aws"]

[[rules]]
id = "generic-api-key"
description = "Generic API Key"
regex = '''(?i)(api_key|apikey|api-key)\s*[:=]\s*['"]?([a-zA-Z0-9_-]{20,})['"]?'''
secretGroup = 2

[[rules]]
id = "private-key"
description = "Private Key"
regex = '''-----BEGIN (RSA |EC |DSA |OPENSSH )?PRIVATE KEY-----'''

Gitleaks CLI

# Scan repository
gitleaks detect --source . --report-format json --report-path gitleaks.json

# Scan specific commit range
gitleaks detect --source . --log-opts="HEAD~10..HEAD"

# Pre-commit hook mode
gitleaks protect --staged

# Verbose output
gitleaks detect --source . --verbose

# Baseline (ignore existing secrets)
gitleaks detect --source . --baseline-path .gitleaks-baseline.json

TruffleHog

# Scan git repository
trufflehog git file://. --json > trufflehog.json

# Scan GitHub repository
trufflehog github --repo=https://github.com/org/repo --json

# Only verified secrets (reduces false positives)
trufflehog git file://. --only-verified

# Scan specific commit range
trufflehog git file://. --since-commit=abc123

# Scan filesystem (not git)
trufflehog filesystem --directory=. --json

detect-secrets

# Install
pip install detect-secrets

# Generate baseline
detect-secrets scan > .secrets.baseline

# Audit baseline (mark false positives)
detect-secrets audit .secrets.baseline

# Scan with baseline (only new secrets)
detect-secrets scan --baseline .secrets.baseline

# Pre-commit hook
detect-secrets-hook --baseline .secrets.baseline

Secret Pattern Reference

# AWS Access Key
AKIA[0-9A-Z]{16}

# AWS Secret Key
[A-Za-z0-9/+=]{40}

# GitHub Token (classic)
ghp_[a-zA-Z0-9]{36}

# GitHub Token (fine-grained)
github_pat_[a-zA-Z0-9]{22}_[a-zA-Z0-9]{59}

# JWT Token
eyJ[a-zA-Z0-9_-]*\.eyJ[a-zA-Z0-9_-]*\.[a-zA-Z0-9_-]*

# Generic API Key
(?i)(api[_-]?key|apikey|api[_-]?secret)\s*[:=]\s*['"]?[a-zA-Z0-9_-]{20,}['"]?

# Private Key Header
-----BEGIN (RSA |EC |DSA |OPENSSH )?PRIVATE KEY-----

# Database Connection String
(?i)(postgres|mysql|mongodb)://[^:]+:[^@]+@

Detection

# Combined scan script
#!/bin/bash
echo "=== Secret Detection ==="

# Gitleaks
gitleaks detect --source . --report-format json --report-path gitleaks.json 2>/dev/null
GITLEAKS_COUNT=$(cat gitleaks.json 2>/dev/null | jq '. | length' || echo 0)

# TruffleHog (verified only)
trufflehog git file://. --only-verified --json 2>/dev/null > trufflehog.json
TRUFFLEHOG_COUNT=$(cat trufflehog.json 2>/dev/null | jq -s '. | length' || echo 0)

echo "Gitleaks: $GITLEAKS_COUNT findings"
echo "TruffleHog (verified): $TRUFFLEHOG_COUNT findings"

if [ "$GITLEAKS_COUNT" -gt 0 ] || [ "$TRUFFLEHOG_COUNT" -gt 0 ]; then
    echo "BLOCKED: Secrets detected"
    exit 1
fi

echo "PASSED: No secrets detected"
exit 0

---

CI/CD Integration

GitHub Actions Workflow

# .github/workflows/security.yml
name: Security Scan

on:
  push:
    branches: [main, dev]
  pull_request:
    branches: [main]

jobs:
  security:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
        with:
          fetch-depth: 0  # Full history for secret scanning

      - name: Python Security (Bandit + pip-audit)
        run: |
          pip install bandit pip-audit
          bandit -r src/ -ll -ii -f json -o bandit.json || true
          pip-audit --format=json -o pip-audit.json || true

      - name: JavaScript Security (npm audit)
        run: |
          npm audit --json > npm-audit.json || true

      - name: SAST (Semgrep)
        uses: returntocorp/semgrep-action@v1
        with:
          config: >-
            p/security-audit
            p/secrets

      - name: Secret Detection (Gitleaks)
        uses: gitleaks/gitleaks-action@v2
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}

      - name: Upload Reports
        uses: actions/upload-artifact@v4
        with:
          name: security-reports
          path: |
            bandit.json
            pip-audit.json
            npm-audit.json

Pre-commit Configuration

# .pre-commit-config.yaml
repos:
  - repo: https://github.com/PyCQA/bandit
    rev: 1.7.7
    hooks:
      - id: bandit
        args: ["-r", "src/", "-ll", "-ii"]
        exclude: ^tests/

  - repo: https://github.com/gitleaks/gitleaks
    rev: v8.18.0
    hooks:
      - id: gitleaks

  - repo: https://github.com/semgrep/semgrep
    rev: v1.52.0
    hooks:
      - id: semgrep
        args: ["--config", "auto", "--error"]

---

Summary Table

Related Skills

• owasp-top-10 - Vulnerability context
• devops-deployment - CI/CD integration
• defense-in-depth - Security layers

Security Audit Template

Use this template to conduct security reviews of APIs, workflows, or entire applications.

Audit Metadata

Project: [Project name] Audit Date: [YYYY-MM-DD] Auditor: [Name/Team] Scope: [What's being audited - specific endpoints, full app, etc.] Risk Level: [Low / Medium / High / Critical]

Executive Summary

[2-3 sentence overview of findings]

Overall Security Posture: [Strong / Adequate / Weak / Critical Issues Found]

Key Findings:

• [Critical Issue 1]
• [High Priority Issue 2]
• [Notable Strength 1]

Recommended Actions: 1. [Most urgent action] 2. [Second priority action] 3. [Third priority action]

---

1. Authentication & Authorization (A01, A07)

Findings

1.1 Authentication Mechanisms

• [ ] Authentication required for all non-public endpoints?
• [ ] JWT/session tokens properly validated?
• [ ] Password requirements meet minimum standards (12+ chars, complexity)?
• [ ] Account lockout after failed attempts?
• [ ] MFA available for sensitive operations?

Issues Found:

1.2 Authorization Checks

• [ ] Resource-level authorization enforced (users can't access others' data)?
• [ ] Role-based access control implemented correctly?
• [ ] Default-deny approach used (explicit allow required)?

Issues Found:

---

2. Input Validation & Injection (A03)

2.1 SQL Injection

• [ ] Parameterized queries used exclusively (no string concatenation)?
• [ ] ORM used correctly (no raw SQL with user input)?

2.2 Input Validation

• [ ] Pydantic validation on all request schemas?
• [ ] Length limits enforced (max string length, array size)?
• [ ] Type validation prevents unexpected types?

2.3 Command Injection

• [ ] No shell=True in subprocess calls?
• [ ] User input never passed to shell commands?

---

3. Cryptography & Data Protection (A02)

3.1 Data in Transit

• [ ] HTTPS enforced in production?
• [ ] Secure cookie settings (httponly, secure, samesite)?

3.2 Data at Rest

• [ ] Passwords hashed with bcrypt/scrypt?
• [ ] Sensitive data encrypted before storage?

3.3 Secrets Management

• [ ] No hardcoded secrets in code?
• [ ] Environment variables used for configuration?
• [ ] .env files in .gitignore?

---

4. Security Misconfiguration (A05)

4.1 Default Configuration

• [ ] Debug mode disabled in production?
• [ ] Default credentials changed?
• [ ] Unnecessary features disabled?
• [ ] Error messages don't leak implementation details?

4.2 Security Headers

• [ ] X-Content-Type-Options: nosniff set?
• [ ] X-Frame-Options: DENY set?
• [ ] Strict-Transport-Security set?
• [ ] Content-Security-Policy defined?

4.3 CORS Configuration

• [ ] CORS origins explicitly whitelisted (not *)?
• [ ] Credentials allowed only for trusted origins?

---

5. Vulnerable Dependencies (A06)

5.1 Dependency Scanning

• [ ] pip-audit run and passed?
• [ ] Dependencies up to date?
• [ ] Lockfile used?

Scan Results:

# Run pip-audit
poetry run pip-audit

# Results:
Critical: [count]
High: [count]
Medium: [count]
Low: [count]

---

6. Logging & Monitoring (A09)

6.1 Security Event Logging

• [ ] Authentication events logged?
• [ ] Authorization failures logged?
• [ ] Critical operations audited?
• [ ] Structured logging used?

6.2 Monitoring & Alerting

• [ ] Failed login monitoring?
• [ ] Rate limit violations tracked?
• [ ] Error rate alerting configured?

---

7. API-Specific Security

7.1 Rate Limiting

• [ ] Rate limits enforced on all public endpoints?
• [ ] Per-user rate limits for authenticated endpoints?

7.2 Request Size Limits

• [ ] Request body size limited?
• [ ] File upload size limited?
• [ ] Array/collection size limited?

7.3 SSRF Protection

• [ ] URL validation for user-provided URLs?
• [ ] Internal network access blocked?
• [ ] Redirect following disabled or limited?

---

Summary of Findings

Critical Issues (Fix Immediately)

1. [Issue description] - [Location]

High Priority Issues (Fix This Sprint)

1. [Issue description] - [Location]

Medium Priority Issues (Fix Next Sprint)

1. [Issue description] - [Location]

Low Priority / Nice to Have

1. [Issue description] - [Location]

Positive Findings (Security Strengths)

• [Good security practice observed]

---

Remediation Plan

---

Re-Audit Schedule

Next Audit Date: [YYYY-MM-DD] Audit Frequency: [Monthly / Quarterly] Responsible Party: [Team/Person]

---

Audit Completed By: [Name] Date: [YYYY-MM-DD]