Security Audit

Run a focused security review of one feature, PR, workflow, or code area. Prioritize exploitable risks, privacy/data exposure, unsafe trust boundaries, and missing defense-in-depth over generic hardening advice.

Core Rules

• Stay read-only unless the user explicitly asks to fix findings.
• Ground every finding in source code, configuration, dependency metadata, runtime behavior, docs, or explicit user context.
• Separate confirmed vulnerabilities from inferred risks. Label inferred risks with confidence.
• Avoid noisy best-practice checklists. Report issues that are actionable and relevant to the audited surface.
• Prefer small, concrete mitigations over broad rewrites.
• Do not test against production systems, use real credentials, mutate data, fuzz live services, run exploit tooling against third-party targets, or disclose secrets.
• If you encounter secrets or sensitive data, do not repeat the secret value. Refer to the path and type only.
• Note when a risk needs product/legal/privacy input rather than a code-only fix.

Inputs

Accept any specific security scope, including: