security-auditlisted

# Security Audit A deliberate, whole-repository security pass. Slower than `/review-security` and run on purpose, not on every change. **Use this when:** You want a deep security look at the whole codebase, not just the latest diff - a feature milestone, a pre-release gate, or when `/review`/`/review-security` nudged you because a change touched auth, crypto, secrets, or a new external entry point. **Don't use this when:** You just want a fast pass on a code change (use `/review-security`), or you are checking dependency versions/CVEs (use `/review-deps`). **The difference from `/review-security`:** that skill reads one change through an attacker's eyes; this skill reads the **whole system** through an attacker's eyes - the surfaces a single diff can never show you (every route's authorization, secrets sitting in history, the crypto used app-wide). ## Critical Rules <rules> 1. **THE REVIEW PHASE REPORTS ONLY** - Reviewing never edits files; findings with exploit receipts are its product. After the report, the same run continues into the auto loop (rule 2), which is what applies fixes 2. **Audit, then auto-fix, with pages** - Running this audit stays a deliberate human choice, but its findings are audited before the report per M2 in `.claude/skills/shared/hitl-loop.md`, so the report shows survivors only plus an Audited out log for the kills. They do not then wait for a human "fix it": after the report, survivors are auto-fixed and re-verified, and each finding exits as