securitylisted

# security — audit, then generate fix specs The normal flow already carries a security baseline (the constitution's Security axis, `review`'s security dimension, `build` phase-5 QA). This is the deep, opt-in pass. It **generates work**, it does not change code. ## Progress tracking `TodoWrite`: one item per phase, plus one per audit pass in `--deep`. ## Phase 0 — schema gate `pact schema --gate`. ## Phase 1 — scope - `--deps` -> dependency vulnerabilities only. - `--scope PATH` -> limit the SAST review to that path. - `--deep` -> fan out: independent `security-auditor` passes with focuses `injection` / `auth` / `crypto` / `config`. Announce the decision. - default -> one full `security-auditor` pass. ## Phase 2 — audit (isolated, defensive only) Dispatch `agents/security-auditor.md`. It covers, in scope: - SAST — injection (SQLi, XSS, command, path traversal), authn/authz gaps, secret leakage, insecure deserialization, SSRF, CSRF, weak crypto, unsafe defaults. - Dependencies — the stack's audit tool. - Config — exposed env, permissive CORS, missing security headers, debug mode. - Compliance — the constitution's Security axis; authz logic vs `project.md` and `accepted` DRs. - Light DAST — only if `[env].dev` runs the app locally; probe the **local** instance, no aggressive testing. It returns typed findings with `severity`, `category`, `file:line`, `evidence`, `recommendation`, `cwe`. **No fixes.** ## Phase 3 — report Print the findings table, grouped by s