security-setup

Set up security hardening: $ARGUMENTS

$ARGUMENTS can include:

• "audit" — scan codebase for security issues and report (no changes)
• "full" — CSP + rate limiting + CORS + validation hardening (default)
• "headers-only" — just HTTP security headers
• "rate-limiting" — just Upstash rate limiting
• Framework hint: "nextjs" or "vite" (auto-detected)
• Empty — full hardening, auto-detect framework

Before Starting

1. Read package.json to detect framework
2. Read src/middleware.ts — add security headers there
3. Read next.config.ts — add HTTP headers config
4. Read src/app/api/ — find API routes needing rate limiting
5. Check if @upstash/ratelimit or @upstash/redis is installed