Security

Output Shape

• Prioritize findings by severity and exploitability.
• Explain what could go wrong, under what conditions, and how to reduce the risk.
• Prefer practical mitigations over abstract warnings.
• Call out when the right fix is documentation, configuration, code, or a quality gate update.

Repo Guidance

• Favor secure defaults that future cloned projects are unlikely to misuse.
• Avoid recommending heavyweight security stacks unless the user explicitly needs them.
• Treat leaked credentials, permissive auth, and unsafe local tooling defaults as high-signal issues.
• Keep security advice concrete enough to implement in the repo, not just discuss in theory.

Anti-Patterns

• Do not inflate minor hygiene issues into critical vulnerabilities.
• Do not recommend complex platforms or dependencies by default.
• Do not give vague advice like "improve security" without naming the boundary and failure mode.
• Do not ignore local-development attack surfaces just because the project is small.