hardenlisted

# Harden Find real vulnerabilities in this codebase and fix them. Not a checklist recital — a working audit that ends with the code actually changed. ## Scope it first Ask the user what to audit if it is ambiguous. Default to the current diff (`git diff` / `git diff --staged`) when there is one, otherwise the files most recently touched. Auditing an entire mature repo in one pass produces a wall of noise nobody acts on; go feature by feature. ## Read the rules Read `AGENTS.md` in the project root for the full SG-1..SG-18 text. If it is not there, read the copy at `${CLAUDE_PLUGIN_ROOT}/../../AGENTS.md`. Cite rule IDs in every finding so the user can look up the reasoning. ## Trace, don't grep Pattern matching finds the easy half. The expensive bugs are structural, so work from the entry points inward: 1. **Enumerate every entry point.** Routes, API handlers, form actions, webhook receivers, server actions, edge functions, message consumers, cron jobs. 2. **For each one, follow the data.** Where does input arrive, what validates it (SG-17), where does it reach a query, a shell, a filesystem path, an outbound request, or an HTML render? 3. **For each one, ask the authorization question twice.** Is the caller authenticated, *and* does the code verify this caller owns this specific object? Missing object-level checks (IDOR) is the most common serious flaw in AI-generated CRUD and it is invisible to grep — the code looks complete because it does have a