security-reviewlisted

# Security review Read the [shared review contract](../../contracts/review-contract.md) before executing this workflow. Its evidence, candidate ledger, execution and verdict rules apply throughout. A focused hunt for **high-confidence, exploitable** vulnerabilities. Not a general code review. Methodology adapted from Anthropic's MIT-licensed `claude-code-security-review` (see `NOTICE`). ## Stage 1 — Scope Ask (or infer) the target: - **Diff** (default): the current branch / a PR — only newly introduced risk. `git diff --merge-base origin/HEAD` or `gh pr diff <PR>` - **Whole repo**: a full audit — partition by area (auth, API, data access, file handling, deserialization, crypto, config/secrets) so each subagent owns a slice. ## Stage 2 — Detect (parallel, host-configured models) Spawn `security-reviewer` subagents — one for a diff, several partitioned by area for a repo audit. Each traces untrusted input → dangerous sink across these OWASP-2025 classes: - Injection (SQL/NoSQL/command/LDAP/XXE/SSTI) - Broken access control (authz bypass, IDOR/BOLA/BFLA, **SSRF**) - Cryptographic failures (hardcoded keys, weak crypto, bad randomness, cert bypass) - Code execution (insecure deserialization, `eval`, XSS) - Authentication & session (JWT flaws, session fixation) - Software/data integrity & supply chain - Sensitive data exposure (logs, PII, debug) **Excluded** (do not report): DoS/rate-limiting, secrets-merely-on-disk, missing defense-in-depth without an exploit path, memory-