inspect-security — Software Security & Threat Exposure Auditor

Domain Rubric

1. Scope & Tolerability Guardrails (What to Ignore)

• Mandatory Target Scope: The user MUST specify an explicit target path (file, directory, or subsystem). If no target scope is provided, halt turn immediately and prompt user: "Please specify an explicit target scope (file, directory, or subsystem) when invoking /inspect-security."; forbid speculative full-repository scans.
• Vulnerability Debt vs. Linter Nits: Confine analysis strictly to actionable threat exposure, broken authorization, cryptographic flaws, taint sinks, and concurrency races; defer basic AST formatting, syntax stylistic preferences, and whitespace entirely to native linters.
• Governing Reference: Evaluate security patterns strictly against references/security-rubric.md.

2. Decision Bifurcation: [LOCAL-FIX] vs. [ARCHITECTURAL-REFACTOR]

• [LOCAL-FIX] (Localized In-Function Patch): Parameterizing raw ORM queries, replacing Math.random() with CSPRNG, adding constant-time timingSafeEqual with pre-hashing, strict DTO schema whitelisting, wrapping streams in io.LimitReader, or pinning JWT algorithms. Route behavior-changing remediation to /changeset; use /forge only with a supported, authorized changeset.
• [ARCHITECTURAL-REFACTOR] (Systemic Structural Hardening): Introducing PostgreSQL Row-Level Security (RLS) for tenant isolation, deploying dedicated Egress Proxies (Smokescreen/Envoy) for SSRF mitigation, implementing Token Family refresh rotation with breach cascades, transitioning balance mutations to atomic conditional SQL / ledgers, or introducing distributed sliding-window rate limiting. Route remediation to /changeset.

Canonical Output Contract

# Security Audit Dossier: <Target Scope>