Auditor Core v2.2 โ€” Engine Methodology

Security Audit Methodology

Applied strictly to authorized scopes, public repositories, and environments explicitly permitted by the client. All research follows Coordinated Disclosure principles โ€” no exploitation, no disruption, no access to production systems.

11 Detectors WSPM v2.2 Scoring AI False-Positive Filter 0 Telemetry

Five-Phase Audit Process

Every scan follows the same reproducible pipeline โ€” deterministic by design.

PHASE 01

Reconnaissance

Before running any scanner, we map the digital territory โ€” trust boundaries, hidden entry points, third-party integrations.

  • Repository structure analysis โ€” files, folders, CI/CD configs
  • GitHub Actions, GitLab CI, Jenkinsfile workflow mapping
  • Third-party integrations and webhook exposure
  • Exclusion of media, build artifacts, and vendor directories
PHASE 02

Multi-Engine Scanning

Auditor Core v2.2 deploys all 11 detectors in parallel. Each engine covers a distinct threat class.

  • Bandit โ€” Python SAST: injection, crypto, subprocess risks
  • Semgrep โ€” multi-language SAST: XSS, SQLi, command injection
  • Gitleaks โ€” secrets in full git history
  • Secret Detector โ€” 30+ patterns across all file types
  • CICD Analyzer โ€” unpinned actions, privileged runners
  • IaC Scanner โ€” Terraform, Docker, K8s, Helm
  • Dependency + License Scanner โ€” CVEs, copyleft exposure
  • Bridge + SAST Scanner โ€” cross-repo exposure, logic flaws
PHASE 03

AI False-Positive Filter

Top findings are sent to AI for contextual verification โ€” eliminating noise before scoring.

  • Gemini 2.5 Flash โ€” primary AI engine
  • Groq (Llama 3.3 70B) โ€” automatic fallback on quota
  • Each finding verdict: AI VERIFIED or AI FALSE POSITIVE
  • Architectural analysis block in final report
  • AI unavailable โ†’ core scan continues without enrichment
Findings
Gemini
Groq
Verdicts
PHASE 04

WSPM v2.2 Scoring

Weighted Security Posture Metric v2.2 transforms raw findings into a single authoritative SPI score (0โ€“100).

  • Critical: weight 10 ยท High: 7 ยท Medium: 4 ยท Low: 1
  • Codebase size normalisation applied
  • AI-confirmed false positives excluded from score
  • Context Intelligence: test/, docs/, examples/ classified NON_RUNTIME โ€” excluded from SPI
  • Gate Override: effective grade capped at C when CRITICAL findings exist in production
  • SPI = 100 โˆ’ (Weighted Score / Normaliser) ร— 100
  • Five posture labels from Critical Risk to Hardened
PHASE 05

Report Generation

Findings, scores, and AI verdicts are assembled into three output formats โ€” PDF, HTML, and JSON.

  • PDF Executive Summary โ€” 7-page document with evidence appendix, remediation roadmap, and attestation block for SOC 2 / cyber insurance
  • Interactive HTML with AI VERIFIED / AI FALSE POSITIVE badges and SOC 2 / CIS / ISO 27001 control tags
  • JSON output with compliance_mapping per finding and framework_summary block for SIEM integration
  • Per-finding CWE mapping to MITRE framework
  • Duplicate aggregation โ€” multiple findings in same file grouped as one block with line list
  • Architectural analysis block from AI layer
PHASE 06

Human Validation

For the professional Audit Service โ€” every finding is manually reviewed for real-world exploitability and impact.

  • Manual verification under authorized, controlled conditions
  • Risk prioritization based on actual threat models
  • Tailored remediation code snippets and config fixes
  • Technical debriefing session with remediation roadmap
This phase applies to the professional Audit Service โ€” not to standalone Auditor Core scans.

WSPM v2.2 Scoring Formula

Weighted Security Posture Metric โ€” deterministic, reproducible, codebase-normalised.

Severity Weights

Critical
ร— 10
High
ร— 7
Medium
ร— 4
Low
ร— 1
Formula
WS = ฮฃ(severity_weight ร— count)
N = log(files + 1) + 1
SPI = max(0, 100 โˆ’ (WS / N) ร— 10)

SPI Posture Labels

0 โ€“ 29
Critical Risk
30 โ€“ 49
High Risk
50 โ€“ 69
Vulnerable
70 โ€“ 89
Resilient
90 โ€“ 100
Hardened
AI-confirmed false positives are excluded from WS before SPI is calculated. This ensures the score reflects real risk โ€” not scanner noise.

v2.2 Intelligence Engine

Two new mechanisms introduced in v2.2 that make scoring more accurate and reports more actionable.

CONTEXT INTELLIGENCE

NON_RUNTIME Exclusion

Findings in non-production directories are classified as NON_RUNTIME and excluded from the SPI calculation by default โ€” eliminating false severity inflation from test and documentation code.

  • test/, tests/, spec/ โ†’ NON_RUNTIME
  • docs/, examples/ โ†’ NON_RUNTIME
  • Detector fixture files recognised as SETUP context
  • Taint analysis and reachability scoring applied before verdict
  • Production code (CORE / INFRA) weighted at full exposure value
GATE OVERRIDE

CRITICAL Grade Cap

When CRITICAL findings exist in production code, the effective grade is capped at C regardless of the mathematical SPI score โ€” resolving the cognitive dissonance of a high SPI alongside a FAIL decision.

  • CRITICAL in production โ†’ max effective grade: C
  • Mathematical SPI still reported โ€” cap is display-only override
  • Eliminates false confidence for CISO and underwriter audiences
  • Applies to PDF, HTML, and JSON output simultaneously
  • Sentinel enforces BLOCK regardless of SPI when CRITICAL present
SPI: 91.4 โ†’ Grade: A (math)
CRITICAL found in production
Effective Grade: C (override)

Ethics & Scope Boundaries

Auditor Core v2.2 is a passive analysis engine โ€” it never modifies, exploits, or disrupts any system.

What We Do

  • Scan authorized repositories and environments
  • Analyse public repositories for research purposes
  • Report findings to authorized parties only
  • Follow Coordinated Disclosure at all times

What We Never Do

  • Exploit vulnerabilities in any environment
  • Access production data or credentials
  • Disrupt CI/CD pipelines or deployments
  • Scan systems without explicit authorization

Zero Telemetry Guarantee

  • No usage data collected or transmitted
  • No scanned code ever leaves your machine
  • AI API calls contain findings only โ€” never source
  • Engine never self-updates or calls home

Ready for a Deep Review?

Run Auditor Core v2.2 yourself โ€” or commission a full professional audit with human validation and remediation roadmap.

Get Auditor Core Request Professional Audit

View a real scan result โ†’ Demo Report