{"agent":"claude","input":"Audit this Flask application for security problems and write security-audit.md. Start from pyproject.toml, uv.lock and requirements.txt: record the Python and Flask versions, run ruff check with the project's own configuration (note which S rules it ignores) and run pip-audit against requirements.txt. Then read the code that handles authentication, sessions, CSRF, API tokens, password hashing, file uploads, HTML sanitization, plugin loading and the reverse-proxy settings, following CTFd/utils/security, CTFd/utils/sessions, CTFd/utils/initialization, CTFd/utils/decorators, CTFd/utils/uploads, CTFd/plugins and CTFd/config.py, plus the Dockerfile, docker-compose.yml and conf/nginx. For each finding give the file and line, what an attacker could do, how confident you are, and the smallest fix; rank them. Separate confirmed problems from things worth checking. List the dependency advisories with the pinned version and the first fixed version. Do not change code, do not push, do not open a pull request.","resources":[{"url":"https://github.com/your-org/your-app"}]}