securitylisted

# Security A security audit pattern: analyze what changed, classify by vulnerability type, dispatch one parallel agent per class, verify every finding yourself, **filter false positives hard**, report only confirmed issues. You are the orchestrator. Each vulnerability class becomes one Explore subagent that reads code fast and cross-checks against current advisories via web search. Never trust an agent's "CRITICAL" finding without reading the cited file yourself. ## How it works ``` You (orchestrator) |-- 1. Discover scope: what changed, what to audit |-- 2. Classify the change surface by risk |-- 3. Dispatch one Explore agent per vulnerability class (in parallel) |-- 4. Each agent: read code, grep patterns, web-search current advisories |-- 5. Collect findings |-- 6. VERIFY every CRITICAL/HIGH yourself — read the cited file:line |-- 7. FILTER false positives aggressively |-- 8. Report only verified findings ``` ## Step 1 — Scope the scan If args give a time window, use git: ```bash git log --oneline --since="<N> days ago" --no-merges --name-only | head -200 ``` If args give a path or "pre-launch", spend 60s reading top-level `README.md`, `AGENTS.md` / `CLAUDE.md`, and the entry-point file to learn: network listener? web UI? CLI? filesystem/keychain/external API access? Multi-tenant or single-user? OSS or hosted? The attack surface determines which classes matter. State your scope back to the user in 3-4 lines before dispatching anything. They'll redirect if