md-audit

## Code Audit (read-only) Perform a read-only code quality scan and return a findings report. Do NOT edit any files. Steps: 1. **Scope** — identify the primary language and entry points (`package.json`, `Cargo.toml`, `go.mod`, `pyproject.toml`, or similar). 2. **Scan** — use `Grep` and `Read` to look for: - Unhandled promise rejections / ignored errors - Hard-coded secrets or credentials (keys, tokens, passwords) - `TODO`/`FIXME`/`HACK` comments that signal known debt - Dead exports (exported symbols with no in-repo import) - Obvious type-safety gaps (unchecked `any`, missing null guards) 3. **Report** — output a findings list sorted by severity (Critical → High → Medium → Low): ``` ## Audit Report — <project name> ### Critical - [file:line] <description> ### High - ... ### Summary <total count> findings across <file count> files scanned. ``` 4. Stop after reporting. Do not apply any fixes.