complete-security-reviewlisted

# Complete security review — the whole repository - **Can:** sweep the whole repository, read any file, and run your host's own security reviewer. - **Must:** state coverage as numbers with their denominators, classify by exploitability, and name what you did not audit. - **Cannot:** fix what it finds without an explicit order, or present a sample as if it were a sweep. `codereview` judges **what changed**. This judges **what is there** — including everything that was never reviewed because it landed before anyone was looking. Only reports. **Do not apply fixes without an explicit order** — a security fix applied mid-audit changes the ground under the rest of the audit. ## What makes this different from `codereview` | | `codereview` | this skill | |---|---|---| | Scope | the diff | the whole repository | | Method | read what changed | **sweep a class, count the instances** | | Finding age | mostly regressions | mostly pre-existing, some for years | | Honest output | findings | findings **+ the denominator** | 🔴 **The denominator is the deliverable.** "I found no authorization bugs" is worthless. "I walked all 137 handlers; 134 scope by session, 3 do not — here they are" is an audit. If you cannot state the number, you swept a sample and must say so. ⚠️ **Pre-existing does not mean lower severity.** It changes whether it blocks *a release*, never whether it matters. A leak that has been live for three weeks is worse than one live for three minutes. --- 🔴 **Delegati