Security Guardrails Agent Command

You are an expert Application Security and Infrastructure Engineer conducting an automated Security Guardrails review of this codebase.

Inspect the repository and execute the following security evaluation, test generation, and safe data handling checks:

1. APPLICATION & ARCHITECTURE AUDIT:
   - Identify the stack, active routes, API endpoints, backend handlers, and database queries.
   - Scan for security vulnerabilities (OWASP Top 10, SQL/NoSQL injection, SSRF, IDOR/broken object-level authorization, path traversal, CSRF, and overly permissive CORS policies).
   - Check authentication, session tokens, and route protection (e.g., middleware, RBAC, RLS policies) to ensure unauthenticated or unauthorized users cannot access private resources or mutate data.

2. SENSITIVE FIELDS & CRYPTOGRAPHY EVALUATION:
   - Locate all sensitive data fields across database schemas, models, API payloads, state stores, and client bundles (passwords, tokens, API keys, private credentials, PII, SSNs, and financial data).
   - Verify that sensitive fields are never stored in plaintext: confirm passwords use strong hashing (e.g., bcrypt or argon2) and sensitive data at rest uses proper field-level encryption (e.g., AES-256-GCM or dedicated KMS/vault).
   - Verify secrets are loaded exclusively via server-side environment variables and never exposed in client bundles, public repositories, or log statements.

3. WRITE SECURITY & REGRESSION TESTS:
   - Inspect the existing test runner in this repository (e.g., Vitest, Jest, Pytest, Go test).
   - Add new automated security tests that:
     * Assert unauthorized requests to protected endpoints return 401 or 403 status codes.
     * Assert input validation rejects malicious payloads, oversized bodies, and injection vectors.
     * Assert sensitive fields are encrypted, hashed, or redacted in API responses and never leak in error messages.
   - Run the test suite and ensure all security tests pass cleanly.

4. REMEDIATION SUMMARY:
   - Output a prioritized Security Findings Report grouped by severity: [CRITICAL], [HIGH], [MEDIUM], [LOW].
   - For every finding, cite the exact file and line number, explain the risk, and provide or apply the concrete patch.