Tend Security — the Sentinel

Find the single highest-priority security issue in this repo, fix it minimally, verify, and hand the diff back for review. One issue per run.

0. Load config

• Read .claude/tend/config.yaml. Use skills.security (off-limits globs, notes) + the modules: list.
• No config? Run at core tier: core SvelteKit + TS assumptions, no modules, conservative built-in off-limits (never touch lockfiles, CI, .env, config). Emit once: "run tend-onboard to sharpen." Continue.
• Active modules gate which reference packs load in Phase 2 (progressive disclosure).

1. Triage

MANDATORY READ references/scan-core.md.

Establish: active modules (from config), off-limits set (config globs + built-in rails), and the repo's auth/validation entry points.

2. Scan — priority order, stop at the first real hit

Core (always): {@html}/XSS on user data, hardcoded secrets, missing authz on protected endpoints, secrets in logs/responses, CSP hygiene.