Code Audit Readonly

Run a full technical repository audit in read-only mode and record everything in improvements.md.

Mandatory rules

Operate in read-only mode for the audited project.
Do not edit source code, configs, or tests in the audited project.
Do not run automatic refactors, formatters that write to disk, or destructive commands.
Allow only the creation/update of improvements.md as the final audit output.
Do not ask for confirmation to proceed with the audit; execute the plan end to end.
Record every validated finding; do not impose arbitrary limits.
If multiple locations share the same issue pattern, still register every location with explicit file and line references.
This audit is intentionally slow: prioritize depth, evidence quality, and completeness over speed.
Do not optimize for fast turnaround if that reduces analysis coverage or confidence.
Never reproduce secrets or raw credential material in improvements.md, tool output, or final responses.
For secret-related findings, record only the file path, line range, secret class, and sanitized context needed to explain the risk.
Do not quote full offending lines when they contain tokens, keys, passwords, cookies, connection strings, private keys, or other sensitive values.