security-audit-lightlisted

# Security Audit (Light) PR-scoped security audit distilled from CSO's methodology. Optimized for additive endpoints, schema changes, small refactors. Single-prong — read the diff, verify each finding end-to-end, output a verdict. No subagent fan-out, no infrastructure passes, no telemetry. ## When to use - User says "security audit", "security review", "OWASP check", "is this safe", "anything fishy?" - Scope is the **current branch / latest uncommitted changes** (1-20 files) - Stack is one of: PHP/Laravel, Python/Django/FastAPI, Node/Express/Nest, Ruby/Rails, Go/Gin, Java/Spring Boot, Rust/Axum ## When NOT to use - Greenfield (no code yet) → use `systematic-debugging` or another skill - User asks for **full codebase audit** → this skill is PR-scoped by design - User wants **proactive scanning** while writing code → defer to `security-best-practices` - Audit depends on infrastructure (CI/CD, deploy pipeline, secrets manager) → out of scope ## Procedure ### Step 1 — Detect stack + scope (30 seconds) Read top-level config files to confirm framework, then **declare scope** explicitly: | Field | Source | Example | |---|---|---| | Stack | `composer.json`, `package.json`, `pyproject.toml`, etc. | Laravel 12 / PHP 8.4 | | Scope | `git diff --stat <baseline>..HEAD` | 5 files, 202 insertions | | Branch | `git branch --show-current` | feat/GYMED-793 | | Baseline SHA | `git rev-parse --short HEAD~1` (or merge-base) | `79d68ef` | **State scope in the output**: "Auditing 5 files