{"agent":"claude","input":"Run a security audit on this ASP.NET Core solution without changing anything. Read global.json, Directory.Build.props, Directory.Packages.props, src/Web/Program.cs, src/Web/DependencyInjection.cs, every file under src/Web/Endpoints and src/Web/Infrastructure, src/Web/appsettings.json and the other appsettings files, src/Web/Web.http, src/Infrastructure/DependencyInjection.cs, src/Infrastructure/Identity, src/Infrastructure/Data/ApplicationDbContextInitialiser.cs, src/Application/Common/Behaviours/AuthorizationBehaviour.cs, src/ServiceDefaults/Extensions.cs, renovate.json and the workflows under .github/workflows first. For the pipeline, report the CORS policy, HSTS and HTTPS redirection, which environments expose OpenAPI, Scalar and the health endpoints, and what the exception handler returns. For identity, list every endpoint MapIdentityApi publishes and which endpoint groups and MediatR requests require authorization, and report the password, lockout, confirmed-account and token lifetime options in effect. Report AllowedHosts, how secrets are read, whether the administrator credentials in Web.http are seeded outside development, and whether any rate limiting or security headers exist. Run dotnet list package --vulnerable --include-transitive and dotnet list package --outdated and quote the output. Write security-audit.md: findings ordered by severity, each with file and line, impact, and a fix written for this solution, then a dependency section, then what the solution already does right. Change no code and open no pull request.","resources":[{"url":"https://github.com/your-org/your-app"}]}