XFSA
XF Security Audit

Catches security exposure before the code lands.

XFBA checks that code is internally consistent. XSIA maps what else breaks when it lands. XFSA is the third gate: on every edit, it scans for secrets, credentials, injection sinks, unsafe deserialization, and authorization gaps. Not every fix is worth shipping at the cost of a security regression. XFSA sees what a code-shaped check can't.

Part of Quality Gates

Connect with GitHub — it's free

What it does

1

Fires on every Edit and Write — alongside XFBA and XSIA.

XFSA runs in the same Stage 1/2 gate as XFBA + XSIA. Hardcoded credentials, secret-like strings, injection sinks (SQL, shell, template), unsafe deserialization, auth checks that were present and disappeared — all caught before the change reaches disk.

2

Tree-indexed rule registry — not a lint list.

Security rules live in the XFMT tree like every other XF artifact: organized, searchable, contradiction-aware. Domain-specific rules (Flask, FastAPI, Flutter, Supabase) route to the right subtree for the project. Stale rules get flagged and pruned.

3

Suppressions trained into XFPA — per-user, per-rule.

Repeatedly suppressing the same rule in the same context trains XFPA to auto-skip it for you. The rule stays firing for first-time users. Per-user trust graduates without weakening the default protection for everyone else.

How it works

1

You ask Claude to edit or write code.

2

XFBA + XSIA + XFSA fire together at PreToolUse.

3

XFSA scans for secrets, injection, deserialization, auth regressions against the project's rule subtree.

4

Clean: stamp fires, edit proceeds.

5

Exposure: edit blocked. Concern surfaced with what + risk + recommended fix.

Other modules