sec-check

Every rule here comes from a mistake that already shipped to a public repo or a live URL. The scripts find candidates. You decide what is real by tracing an attacker path through the code.

The one idea

Anything the client can reach, an attacker can reach with curl and no browser. That covers every exported query, mutation, action, every HTTP route, every env var with a client prefix, and every commit ever pushed. Login screens, hidden buttons, and obscure function names protect nothing.

Pick a mode

Mode	When	What you produce
Quick check (default)	Before a deploy, after a feature, "is this safe"	Fixes in the code plus a short report
Diff check	A PR, a branch, or uncommitted work	Same gate, limited to changed files and the code they call
Verify a fix	"Is this fixed", before closing a finding	One verdict per finding: fixed, still vulnerable, or inconclusive
Full audit	The user says audit, pen test, find every vulnerability, or wants a report file	Threat map, ledger, validated findings, and coverage in a run folder. Follow references/audit.md

Stay in quick check unless the user asks for another mode. Every mode uses the finding gate below, starts by reading the repo's security changelog when one exists, and ends by logging the run (step 10).