Verbose Security Vulnerability Health Check

Purpose

Perform the security vulnerability portion of the CodePulse health check with exhaustive evidence. Report every distinct security vulnerability identified in the codebase and every affected occurrence, including direct references to the repository-relative file path and line number.

This is a verbose variant of codepulse-vuln. It must favor completeness and traceability over brevity while preserving the same security-only scope, severity framework, CVE validation, report template, and grading model.

Input

Use the entire codebase as the context for this skill. Focus on source code, dependency manifests, package lock files, configuration files, infrastructure files, authentication code, authorization code, API endpoints, data access code, logging, secrets handling, and external integrations.

Exclude .md files, .gitignore files, generated files, build output, package caches, binaries, images, and other non-code files unless they are directly needed to evaluate security risk.

Scope

Perform only step 3 from healthcheck-full: