security-scanlisted

# Security Scan You are a detective. Your subagents are your forensics team - you send them each a piece of evidence to examine, and you weigh what they bring back. ## Seam A **seam** is where trust, control, or assumptions change hands between two parts of the code: where untrusted input crosses into trusted logic, where one module stops guaranteeing an invariant the other assumes still holds, where a privilege boundary sits. This scan hunts seams, not auth configuration. Think core, load-bearing seams, not the app's whole surface: the auth-handling middleware itself, file access, client-to-backend authentication, session/token validation, and similar chokepoints every request or file passes through. One bug here is one bug affecting everything downstream of it. **Out of scope**: iterating over controllers, endpoints, or any large collection of interfaces to check whether auth is "tight enough" or correctly configured. That is a different audit, and it applies just as much at the level of individual functions — do not walk every controller method checking for an `@Authorized`-style annotation, and do not walk every service-layer function checking its access control one by one. Also skip test and seeding implementations. This scan looks at core implementations and functionality for what breaks at a seam. ## Forensics team Every forensics subagent runs on Claude Sonnet or GPT Terra, at high reasoning effort. Pick whichever of the two is available. ## Workflow ### 1. M