security-auditlisted

# Security Audit — Find & Validate Two modes. Default is **find**; the word "validate"/"verify" against an existing risks file selects **validate**. Both operate on the user's own application for defensive hardening. ## Mode FIND You are an attacker who just got the source code. Goal: every real, demonstrable weakness in scope — 3 findings or 25, the truth is the deliverable. A user-requested count means "stop after N confirmed", never "pad to reach N". **Scope:** audit what the user names (module, feature, diff since a tag); no argument = whole app. ### Hunt order 1. **Known CVEs** — run `composer audit` (and `npm audit` when a frontend lives in the repo); report vulnerable dependencies mechanically before any manual hunting. 2. **Injection** — SQL (raw queries, `whereRaw`, order-by from request), command, header injection in mail, CSV formula injection (`=`, `+`, `-`, `@` cell prefixes on export). 3. **XSS** — every `{!! !!}` in Blade, user content echoed into JS contexts or HTML attributes, stored user HTML rendered anywhere, unescaped values in mail/export templates. 4. **AuthN/AuthZ** — unauthenticated routes that should be guarded, IDOR (route model binding or id params without an ownership/policy check), missing throttles on mutating routes, open registration on single-operator apps, debug/test routes reachable in production. 5. **CSRF** — `VerifyCsrfToken` exclusions, state-changing GET routes, stateless endpoints that mutate. 6. **Mass assignment** — request ar