Cloudflare security-audit-skill finds 18 candidates, 0 confirmed bugs

The run is an unusually concrete look at how a two-AI audit behaves in practice. The finder produced 18 candidates on a codebase of 255 web-side TypeScript files and 18 API routes, and 5 were dropped once a second AI tried to knock them down. But the human still had work: the report contained mistakes such as pointing to test files that do not exist, and 7 descriptions had to be corrected.

The setup itself shaped what could be found. The developer excluded the docs/ folder that held the earlier ASVS judgment records, to keep the audit independent, but that folder also held the design documents needed to judge specifications. The scope covered only the web side, so the mobile app was never checked.

Compared with the earlier 253-item ASVS review, which checked requirements one by one, this skill traces code paths looking for risky routes. It overlapped with known issues, raised paths not directly examined before, and showed that some explanatory notes from the ASVS record applied to only part of the processing. The pass verdict did not change, but the notes needed revisiting. The 13 open items are being triaged into three groups: deciding specifications, checking cloud settings, and reproducing behavior locally.