security-sweeplisted

# security-sweep A defensive security audit of a repository: find what an attacker could use, report how to fix it. Every finding ships with its remediation; nothing in the report teaches exploitation beyond what is needed to verify the fix. **Read-only**, with one exception: never copy, log, or echo discovered secret values anywhere, including the report. Reference secrets by file:line and type only. ## Lenses | Lens | Hunting for | |------|-------------| | Secrets | Credentials, tokens, API keys, private keys in the working tree AND full git history (`git log --all -p` with pattern grep); high-entropy strings in config | | Dependencies | Known CVEs (`npm audit`, `pip-audit`, `govulncheck`, `cargo audit` as applicable), abandoned packages, pinning hygiene, lockfile present | | Input handling | Injection surfaces (SQL, shell, path traversal, template), missing validation at trust boundaries, unsafe deserialization | | AuthN/AuthZ | Unprotected routes and endpoints, missing authorization checks distinct from authentication, weak hashing, session handling | | Exposure | Destructive endpoints reachable without auth (a DELETE route an agent or crawler can hit), debug modes, verbose errors leaking internals, internal hostnames/private IPs/PII in code and docs | Lens guidance: - Secrets in history are findings even when the tree is clean; remediation is rotation first, history rewrite second (the publish-readiness skill has the full rewrite recipe). - For exposure, think about