security-passlisted

# Security Pass A staged security hardening workflow, distinct from a one-shot scan. The shape is: **recon → numbered checklist → approval → atomic remediation commits, typecheck-gated per task.** This matches the workflow the user validated in prior passes; follow it rather than diving straight into edits. For a quick read-only scan of the current diff, use the built-in `/security-review` instead. This skill is for when there is real remediation work to plan and land safely. ## Phase 1 — Recon (read-only) 1. Map the attack surface relevant to the change or area: entry points (routes, handlers, server actions), trust boundaries, auth/authz checks, data flowing from untrusted input to sinks (DB, shell, HTML, file system, external calls), secret handling, and dependency surface. 2. Fan out with `Explore` subagents per subsystem when the surface is broad — keep raw findings out of the main context, per the persona's session-hygiene rule. 3. Catalog candidate issues with category + severity. Do not fix anything yet. ## Phase 2 — Numbered checklist (for approval) Produce a single ordered checklist. Each item: | # | Category | Severity | Location (`file:line`) | Issue | Proposed fix | Effort | |---|---|---|---|---|---|---| - Severity by exploitability × blast radius. Order most-critical first. - Each item must be independently committable — that is what makes the next phase atomic. - **Stop here and wait for approval.** The user picks which items proceed (and may defer some