website-securitylisted

# Website Security Find exploitable weaknesses, explain the user or business impact, and provide practical fixes with verification. Work across source code, deployment configuration, and runtime behavior according to available access. A browser-only review cannot verify server-side payment integrity or database isolation. ## Start with scope, then keep working 1. Read applicable repository instructions. Identify the supplied repository, target origins, environment, and existing authorization. Infer the stack from manifests, routes, migrations, infrastructure, and integrations; do not assume a framework or gateway. 2. Record scope: repository revision or working-tree snapshot, exact origins, production/staging/local, identities and tenant fixtures, permitted actions, exclusions, and available access. Separate a local code audit from a deployed-site assessment. 3. A request to audit the user's site authorizes source/configuration review and ordinary browsing of that site. An explicit pentest request covers bounded tests of the identified user-controlled target; it does not include unrelated hosts, provider infrastructure, real charges, or destructive activity. Reuse authorization already given. If permission for a remote target is unclear, request missing scope while continuing local review. Read [execution.md](references/execution.md) before active testing. 4. Choose the useful mode: **source review**, **runtime review**, **scoped pentest**, or **remediate and retest**. Com