Find security defects relative to repository security docs and existing scanners. Do not invent CORS, encryption, password, or header policy. Stay report-only unless the user asked to fix.
- Read the repository security docs. If missing, stop and ask; do not invent a bar.
- Spawn 2–3 read-only explorers on authn/authz, secret/exposure, and input validation for the changed paths. Reconcile trigger and consequence yourself.
- Validate each suspected issue with a trigger and consequence. Skip invented CVEs and timings.
- If authorized, run existing security scripts or CI jobs from the docs or package.json. Record passed, failed, or not run.
- If fixes are authorized, change the owning cause. Policy changes need a human. Docs:
/w-docsif behavior or commands changed.
