What problem does it solve? Teams often assume security checks exist when they do not, or rely on stale documentation claiming scans passed. This Skill audits the repository's actual security posture by inspecting current enforcement files, CI workflows, auth-debug surfaces, and secret handling, then reports concrete gaps instead of implying coverage that does not exist. ## Core Features & Use Cases - Auth-debug surface review: Verifies that production override flags and debug tools fail closed by default, using apps/server/src/auth/policy.ts as the source of truth. - CI security coverage audit: Compares what workflows like quality-gates.yml and deploy pipelines actually run against the risks documented in docs/launch-risks.md. - Dependency and secret risk assessment: Reviews dependency vulnerabilities and secret handling at trust boundaries, reporting missing automation explicitly. - Use Case: Before a production launch, ask for a security scan of the release branch to confirm which checks CI actually runs, whether auth-debug overrides are disabled in production, and which known risks remain unmitigated. ## Quick Start Ask the AI to run a security scan of the current branch and report which CI security checks actually run, whether production auth-debug overrides fail closed, and what gaps remain.
