security-auditlisted

# zuvo:security-audit — Application Security Audit Comprehensive security assessment across 15 dimensions (S1-S15) covering OWASP Top 10 2021, OWASP LLM Top 10, application security, AI/LLM integration security, and infrastructure hardening. Every finding is filtered through a Sentry-inspired 3-tier confidence model: HIGH confidence findings in the main report, MEDIUM in a "Needs Verification" section, LOW excluded entirely. **When to use:** Before releases, after adding auth or payment flows, after security incidents, periodic quarterly health check, when onboarding a new codebase. **Out of scope:** Single-file code review (use `zuvo:review`), API contract audit (use `zuvo:api-audit`), performance issues (use `zuvo:performance-audit`), penetration testing with exploit verification (use `zuvo:pentest`). ## Argument Parsing | Argument | Effect | |----------|--------| | `[path]` | Audit a specific directory or module | | `full` | Audit the entire project | | `--live-url <url>` | Enable Phase 8 (live probing) against the specified URL | | `--static` | Static analysis only -- skip Phase 8 even if `--live-url` present | | `--quick` | Quick mode: secrets + auth coverage + critical gates only | | `--persist-backlog` | Emit backlog entries for CRITICAL/HIGH findings | | `--strict-v2` | Count the new v2 vulnerability classes toward the HIGH/CRITICAL gate total. Default: warning-only grace (see below) | ### v2 class grace (CI-safety) — shared by security-audit AND pentest The **1