AuditThis.ai

References

Considered and excluded

Sources and tools weighed for the reference register and left out of it.

Recorded so that the decision is not re-litigated without new information. Candidates and the reason each was excluded:

  • OWASP API Security Top 10: overlaps ASVS. Reconsider as Tier 2 for API-centric projects.
  • Chrome's developer documentation on extensions: its repository was archived in November 2023 and the live pages are not in an open repository; MDN's browser-extension documentation covers the ground and notes where Chrome differs.
  • OWASP AI Exchange: overlaps the LLM Top 10 and the GRC Library AI domain.
  • OWASP Machine Learning Security Top 10: overlaps ATLAS and the LLM Top 10.
  • OWASP Top 10 Privacy Risks: no top-level licence file found; DataGrail covers the workstream.
  • REUSE: would cover licence compliance of the project's own code, which nothing in the register does, but no top-level licence file found. Open decision.
  • Agent Control Standard: Apache 2.0; announced 1 Sept 2026. Reconsider as Tier 2 once mature.
  • WCAG: accessibility; W3C Document Licence. Reconsider as Tier 2 for projects with a user-facing interface.
  • CNCF TAG Security: mixed licensing. Reconsider as Tier 2 for Kubernetes deployments alongside kube-bench.
  • Vale: prose linter; tooling, and would need a Clean Language rule set written for it.
  • arc42: architecture documentation template; reconsider when architecture documentation is a handover deliverable.
  • The Twelve-Factor App: dated operability heuristics; WGO's operational perspective covers the ground.
  • Semgrep: the engine is LGPL 2.1, but its rule library is under the Semgrep Rules License, which limits use to the user's own internal business purposes and does not address assessing someone else's code. Reconsider if an openly licensed rule set is verified.
  • TruffleHog: overlaps Gitleaks for repositories, and by default it tries each credential it finds against that credential's provider, which the conduct rules forbid. Reconsider for sources Gitleaks cannot read, run with --no-verification.
  • Strix: autonomous AI penetration testing that runs the target, writes working exploits, and sends code to a model provider; outside the method's read-only phases and execution options.
  • Claude Code Security Reviewer (GitHub Action): needs write access to post pull request comments and reviews only diffs; the Cloudflare security-audit-skill already supplies code-review guidance.