What does a Magento security audit cover?

A full Magento security audit covers four layers: (1) the application, OWASP Top 10 testing of the storefront, admin and APIs (XSS, SQL injection, CSRF, broken access control); (2) patches, an APSB security patch gap analysis against your exact version; (3) dependencies, a CVE audit of every third-party extension and Composer package; and (4) infrastructure, HTTP headers, server config and admin exposure. You get a single prioritised report at the end.