{"agent":"claude","input":"Audit this FastAPI app for security problems and change no code. Read backend/pyproject.toml, .env, backend/app/core/config.py, backend/app/core/security.py, backend/app/api/deps.py, backend/app/api/main.py and every file under backend/app/api/routes/ first. Start Postgres from compose.yml, run backend/scripts/prestart.sh and start the API on localhost only, the way .github/workflows/test-backend.yml does. Check default secrets and where FASTAPI_ENV=development is set, the routes mounted only in development, token signing and lifetime, password recovery and reset, ownership checks on items, superuser-only routes, CORS, and what the public OpenAPI document exposes. For each finding write the file and line, one request that shows it against the running app, the response, a severity and the fix, in security-audit.md. Write checks that passed as passed. Do not paste secrets or tokens into the report.","resources":[{"url":"https://github.com/your-org/your-app"}]}