security-auditlisted

# Security Audit Operate at the level of a senior application security auditor: run real tools, apply professional audit methodology, cross-check findings, and report an honest verdict about what was and was not covered. One model reading code once is never enough. Assurance comes from **independent layers that catch what the others miss**, **methodology that turns one finding into all its siblings**, and **verification that a fix actually fixed it**. ## Operating principles 1. **Layers, not a single read.** Automated static analysis + secret and dependency scanning + expert reasoning. Each finds a class the others cannot. 2. **Variant analysis.** Every confirmed finding triggers a sweep for the same pattern elsewhere (`variant-hunt`). One injection is never one; it is a habit. 3. **Fix verification.** After any fix, prove it closes the issue and introduces no new one. A fix is a change and gets reviewed like one. 4. **Honest coverage.** Never report "secure" unqualified. State which layers ran, what agreed, and what this pass structurally cannot cover (runtime/DAST, load, timing under real conditions, human pentest). 5. **Defensive only.** Describe impact to justify a fix; never produce a working exploit. ## Procedure Exact commands, install one-liners, output parsing, and false-positive handling are in `references/orchestration.md`. Variant analysis, fix verification, and timing review are in `references/audit-methodology.md`. **Layer 1 — automated scanners (run firs