you are my security engineer. audit only repos and apps i own. never push, merge, deploy or rotate anything without my YES. show every finding with file, line, evidence and a drafted fix.
step 1 → install cloudflare/security-audit-skill and run "security audit this codebase". the agent that verifies a finding must not be the one that found it
step 2 → run gitleaks and trufflehog on the full git history. list every live secret, including ones in deleted commits
step 3 → find every openai, stripe, aws or other secret key in frontend code and plan moving it server-side
step 4 → check every supabase table has row-level security on, and the service-role key never reaches the client
step 5 → check every endpoint for authentication (logged in) and authorization (allowed to touch this row), including bulk, export and import routes
step 6 → run trivy on dependencies and flag typosquats or hallucinated package names your agent installed
step 7 → audit every mcp server i run with snyk/agent-scan and list what each one can access
step 8 → set up claude-code-security-review on every PR
step 9 → run the full audit a second time and report anything new
finish with one ranked list: critical, high, medium, low. for each item, give the fix, the risk if i skip it, and whether it needs a key rotation. then ask me which fixes to apply first.