security-prechecklisted

# Security Pre-check (before an external audit) Sweep the codebase with the same criteria an external security team would use, and fix findings ahead of time. ## 1. Scan (parallel) Run concurrently: ``` Agent(subagent_type: "security-audit") — grep-based scan of the 12 P0 code items (hardcoded secrets, missing auth, PII logging, ...) + 8 agent-config items (.claude/ hooks, MCP, permissions, prompt injection) ``` ```bash # SonarQube security hotspots (TO_REVIEW only) — skip this step with a note if the # project has no sonar-project.properties. Never hardcode the host or token: # use $SONAR_HOST_URL / $SONAR_TOKEN from the environment. if [ -f sonar-project.properties ]; then key=$(grep 'sonar.projectKey' sonar-project.properties | cut -d= -f2-) curl -s -u "${SONAR_TOKEN}:" \ "${SONAR_HOST_URL}/api/hotspots/search?projectKey=$key&status=TO_REVIEW&ps=500" \ | python3 -c "import sys,json; d=json.load(sys.stdin); print('TO_REVIEW:', len(d['hotspots'])); [print(h['ruleKey'], h['component'], h.get('line','')) for h in d['hotspots']]" fi ``` The security-audit agent produces better results when its prompt names this project's concrete context (auth mechanism, session handling, CORS config, data-access layer, PII fields). Don't describe these from memory — at run time, grep the repo for its auth/session/CORS/data-access entry points and include what you actually find. ## 2. Grading + report - **P0 (critical)**: escalate immediately. Hardcoded secrets, auth byp