{"agent":"claude","input":"Inventory the attached Express app in endpoints.md. Follow app.use and Router mounts, route declaration order, auth middleware and handlers through to parameter validation and ownership checks. List every method/path, handler file:line, path/query/body fields and expected authentication. Use the lockfile and documented setup to start a disposable local instance with a sandbox-owned database and fresh local secrets. Probe routes without credentials where safe, recording status and response type. Distinguish public reads and registration from unexpectedly accessible protected operations. Record all unverified routes. Do not contact production, edit source, push or open a PR.","resources":[{"url":"https://github.com/your-org/your-app"}]}