{"agent":"claude","input":"Audit this Elixir and Phoenix application and write security-audit.md. Set it up as .github/workflows/main.yml does: the Postgres service, mix deps.get, mix compile --warnings-as-errors and mix test once. Run mix hex.audit; install mix_audit and sobelow as escripts in the sandbox without editing mix.exs or mix.lock, and run both. Then read lib/hexpm_web/router.ex and every plug under lib/hexpm_web/plugs, especially attack.ex, content_security_policy.ex and read_only.ex, the auth and session modules, config/runtime.exs against config/dev.exs and config/test.exs for checked-in secrets, the Dockerfile, and .github for what CodeQL, dependency review and Dependabot already cover. For each finding write the file and line, what you ran or read to confirm it, severity and a fix. Say which tool findings you could not confirm. Do not paste secrets into the report. Change no code.","resources":[{"url":"https://github.com/your-org/your-app"}]}