---
description: Security-focused review covering OWASP-style categories
argument-hint: "[file path, diff, or feature to audit]"
subagent: true
fork: true
---
Security-audit: $@

Structure your answer as:
1. **Trust boundary** — where untrusted input enters, where sensitive data leaves; map the attack surface in one paragraph
2. **Findings** — grouped by severity (Critical / High / Medium / Low / Info). For each:
   - **Category** — one of: Injection, AuthN/AuthZ, Secrets, Crypto, Input validation, Output encoding, Deserialization, SSRF, Path traversal, Race/TOC-TOU, Dependency, Logging/PII, Configuration, Supply chain
   - **Location** — file, line, function
   - **Description** — the vulnerability, with a concrete exploit scenario
   - **Fix** — the minimal secure change, with a code snippet
3. **Missing controls** — auth, rate limiting, audit logging, CSRF/CORS, headers, etc. that should exist but don't
4. **Dependencies** — any third-party packages with known CVEs in this surface (if you can determine versions)
5. **Threat model gaps** — what's out of scope for this audit but worth a separate pass

Be concrete and adversarial — describe a real attack, not "consider validating input." If the code is sound, say so explicitly and explain what you'd look for if it weren't. Do not pad with general security advice that doesn't apply to the specific code.
