security-auditlisted

# Security audit Read the [shared review contract](../../contracts/review-contract.md) before executing this workflow. Its evidence, candidate ledger, execution and verdict rules apply throughout. Audit five categories, not a quota of five vulnerabilities. Read [the audit contract](references/audit-contract.md) before analysis and [the data contract](references/data-contract.md) before producing artifacts. `assets/example-audit.json` is synthetic demonstration data, never target evidence. 1. Resolve target, revision, dirty state, scope and an output directory outside the target checkout for verified audits (so artifacts do not invalidate the dirty digest). Inventory stack, handlers, data access, authorization gates, deploy, history and frontend artifacts. 2. Build a coverage ledger before analysis. Partition independent work by category or route family using native subagents when available and authorized. Inherit host model and permissions. Otherwise work sequentially and disclose that the refutation pass was not independent. 3. Trace entry points to guards and sinks. Inspect EVERY inventoried backend handler for IDOR. Record inaccessible/generated/dynamic or undiscovered routes, unavailable history and missing bundles as limitations. No sample is exhaustive. 4. Refute every candidate against actual code, callers and framework behavior. Keep CONFIRMED findings only at confidence >= 8/10. Record unresolved concerns as limitations. Do not run live