Security Baseline

Create the local project profile that helps /security:scan classify severity and keep scan artifacts out of git.

Step 1: Inspect Project

Run:

mkdir -p .security
"${CLAUDE_PLUGIN_ROOT}/scripts/recon.sh" . | tee .security/recon.json
"${CLAUDE_PLUGIN_ROOT}/scripts/detect-tools.sh" | tee .security/tools.json

Read .security/recon.json.

Step 2: Ask for Security Profile

Ask concise questions when .security/profile.json does not exist or --refresh is passed: