awesome-leak-auditlisted

# Public Client Leak Audit Audit a public client codebase that talks to a private backend. Goal: the public surface must be *self-contained* — it may reveal the calls it makes and the data shapes it exchanges (unavoidable for any shipped client), but nothing beyond that. Every extra detail about how the server works is free reconnaissance for an attacker and a lever for abuse. This skill produces three things: a findings list (leaks + client-side security holes, each with `file:line` and severity), a set of applied fixes, and a report with residual recommendations. Reference files (load on demand — read the one you need, don't inline all of them): - [`references/leak-taxonomy.md`](references/leak-taxonomy.md) — the categories of disclosure to hunt, why each matters, and starter search patterns. Read it before the first sweep of the repository. - [`references/rewrite-rules.md`](references/rewrite-rules.md) — the comment/string rewrite rule with before/after examples; how to decide keep-vs-cut. Read it when a finding is about to be rewritten, not while hunting. - [`references/client-hardening.md`](references/client-hardening.md) — runtime-independent client-side security checklist (capabilities, cross-context entry points, tokens, network, build config, supply chain). Read it at the hardening phase, whatever the client type. - [`references/browser-client.md`](references/browser-client.md) — the browser half of that checklist (extension permissions, storage tiers, DOM/CSS sin