Security Audit Report

Use this template when recording the results of a security audit. Completed reports belong in the process/ section.

When to Use

• Performing a periodic security review of a component or service.
• Auditing authentication, authorization, secrets management, or tenant isolation.
• Documenting findings for compliance or remediation tracking.

Target Section

process/

Template

---
title: "Security Audit Report: Scope / Component"
tags: [security-audit, compliance]
domain: process
maturity: published
author: Security Engineer
---

# Security Audit Report: [Scope / Component]

**Author**: Security Engineer
**Date**: YYYY-MM-DD
**Status**: Draft | In Review | Final
**Audit Period**: YYYY-MM-DD to YYYY-MM-DD

## Executive Summary

Brief overview of the audit scope, key findings and overall risk assessment.

**Overall Risk Level**: Critical | High | Medium | Low

## Scope

- **Components audited**: [list of components, services or features reviewed]
- **Areas covered**: Authentication | Authorization | Secrets Management | Network Security | Dependency Vulnerabilities | Tenant Isolation
- **Out of scope**: [explicitly list what was not reviewed]

## Findings

### Finding 1: [Title]

- **Severity**: Critical | High | Medium | Low | Informational
- **Category**: Authentication | Authorization | Secrets | Network | Dependencies | Data Exposure
- **Affected Component**: [component or file path]
- **Description**: Detailed description of the vulnerability or issue.
- **Impact**: What could happen if this issue is exploited.
- **Evidence**: Code snippets, configuration excerpts or test results demonstrating the issue.
- **Remediation**: Specific steps to fix the issue.
- **Assigned To**: [Back End Engineer | Front End Engineer | DevOps Engineer]
- **Priority**: Immediate | Next Sprint | Backlog

### Finding 2: [Title]

[Same structure as above]

## Summary Table

| # | Finding | Severity | Category | Status | Assigned To |
|---|---|---|---|---|---|
| 1 | [Title] | High | Authorization | Open | Back End Engineer |
| 2 | [Title] | Medium | Secrets | Open | DevOps Engineer |

## Positive Observations

List security practices that are working well and should be maintained.

## Recommendations

General recommendations for improving the security posture beyond specific findings.

## Follow-Up

- **Next audit date**: YYYY-MM-DD
- **Open items to track**: [link to GitHub issues or task list]