security-audit-v2listed

# Security Audit v2 — Domain-Driven Security Assessment Engine ## Objective Perform a rigorous, structured white-box security audit of a codebase. Identify real, exploitable vulnerabilities — not theoretical static analysis noise — and prove each finding with a failing test before reporting it. Key deliverables produced for each run: 1. **Scope & Preconditions Agreement** (`00-scope.md`): negotiated upfront with the user to filter noise (secrets, dev configs, etc.). 2. **Domain Sprint Backlogs & Notes** (`domains/<domain>/tasks.md`): exhaustive checklist-driven verification per functional domain. 3. **Structured Finding List & PoCs** (`poc-tests/`, `findings.json`): proven vulnerabilities with CVSS v3.1 scores, reproducibility state, and reachability. 4. **State-of-the-Art HTML Report** (`report.html`): executive-grade, interactive, filterable report with KPIs, CVSS tables, reproducibility badges, and Mermaid attack chains. 5. **Full Markdown Report** (`full-report.md`) and **Executive Summary** (`summary.md`). **Golden Rule:** Leave the repository untouched. Every artifact lives in `.security-audit/<run>/` or in isolated git worktrees torn down upon completion. Never commit to the user's branch or modify tracked files outside a worktree. --- ## Phase 0 — Setup & Upfront Scope Negotiation ### 1. Run Initialization 1. Create a timestamped output directory at `.security-audit/<YYYY-MM-DD-HHMM>/`. Never overwrite previous runs. 2. Identify the project profile: languages,