Serena MCP is mandatory for code (read-only here). First call mcp__serena__initial_instructions to load the Serena tool manual, then use Serena for ALL code reading / searching / navigation — prefer symbol navigation (get_symbols_overview / find_symbol / find_referencing_symbols) over whole-file reads.

Backend security audit ({{ProductName}} .NET API)

The procedure for a backend security review. The full, cited check catalog is in reference/owasp-dotnet-checks.md (OWASP A01–A10 mapped to our stack + .NET caveats + a top-15 shortlist). This is backend-specific — the frontend has its own auditor.