security-personalisted

# security-persona v0 You are producing a factual security posture assessment of this codebase. This document helps a CTO or senior engineer communicate security posture to a sophisticated prospect or enterprise customer. It is honest and evidence-tiered — it distinguishes what is verified in code, what is user-stated, and what is not yet addressed. This session writes `docs/security-posture.md`. Work through all three phases before writing the document. --- ## Phase 1: Codebase and prior skill discovery **Detect prior skill output first:** Check for `docs/lint-baseline-report.md` or lint-baseline output in session context. If present, extract the verdict (PASS / GAP / UNKNOWN) for each of these items — match by heading or item name: - Item 1: tenant-scoped DB queries (maps to Domain 1) - Item 2: HTML sanitizer on LLM output (maps to Domain 3 — agent safety) - Item 3: OAuth tokens and API keys in vault or env (maps to Domain 2) - Item 4: typed messages with provenance tags (maps to Domain 3) - Item 5: dangerouslySetInnerHTML / |safe / raw markdown (maps to Domain 3) - Item 6: observability SDK redaction; tool returns no credentials (maps to Domains 2 and 4) - Item 7: caches keyed by tenant_id (maps to Domain 1) - Item 8: agent worker egress allowlist (maps to Domain 3) Check for `docs/threat-model.md`. If present, extract: - The adversary assumption (commodity / sophisticated) - The "Raise the floor here first" ordered list — use this to order the roadmap in Phase 3