security-baseline-reviewlisted

# Security Baseline Review ## Goal Review a public repository for baseline security hygiene without exploiting systems, exposing sensitive data, or overclaiming vulnerability status. ## When to use - The user asks for a public repo security readiness check. - Secret hygiene, CI permissions, dependency policy, or `SECURITY.md` needs review. - A repository is about to be published. ## When not to use - The user asks for exploit development or offensive instructions. - A full code vulnerability audit is required beyond maintainer hygiene. - Current CVE status is required but live advisory data is unavailable. ## Inputs to inspect - `.gitignore`, `.env.example`, config samples, workflows, `SECURITY.md`, README, and contribution docs. - Dependency manifests, lockfiles, and update automation config. - Repository settings checklist when live GitHub access is authorized. ## Review rubric Check obvious secret patterns, sensitive examples, CI permissions, untrusted pull request behavior, dependency update policy, security reporting path, branch protection notes, and public/private boundary clarity. Read `references/security-checklist.md` for detail. ## Workflow 1. Inspect public-facing files and config examples. 2. Search for obvious secret-like patterns without printing sensitive values. 3. Review workflow permissions and risky shell patterns. 4. Check dependency and security policy coverage. 5. Recommend safer defaults and rotation if exposure is suspected. 6. Separate co