auditsmithlisted

# Auditsmith Audit a codebase and produce findings with evidence — not a ticked checklist. The ten reference files in `references/` hold the checklists. This file is how to *run* them: scope the audit, gather evidence, judge severity, report, and where possible convert findings into CI rules so they can't regress. ## The core discipline A checklist item is a **question to investigate**, not a box to tick. The difference between a useful audit and a worthless one: - **Every finding cites evidence** — `file:line`, the offending code, and what specifically is wrong. No finding without a location. - **Never report an item you didn't verify.** If you couldn't check something (no access, needs runtime, needs the app deployed), say so explicitly in a "not verified" list. Silence implies you checked and it passed — that's how audits mislead. - **Never invent findings to fill a section.** A section with nothing wrong gets "no issues found," and that's a good result. Padding an audit destroys its signal. - **Report what's there, not what the checklist expects.** The checklists are React/TS/edge-flavored; adapt to whatever stack is actually in front of you and drop items that don't apply rather than forcing them. ## When not to run this Skip Auditsmith and answer directly if any of these are true: - **Pure infrastructure / DevOps with no application code** — Terraform-only, Helm-only, pipeline YAML. There's nothing here for the ten reference files to bite on. - **Writing new fea